Zoom released fixes for two vulnerabilities in its Windows app this week, and one of them is rated critical. Here's what they could let hackers do, and how to make sure every computer in your organization gets the update.
Risk Level
Read Time
If your organization runs on video calls, there's a good chance Zoom Workplace is installed on nearly every Windows computer you own. On November 10, Zoom published two new security bulletins for its Windows app. One flaw is rated critical and the other is rated high. Both could let a hacker gain far more control than they should have, and neither requires the hacker to log in first.
You may remember in another ACT post that Zoom has had its share of security growing pains. The good news this time is that Zoom found and fixed these flaws before anyone is known to have used them. The bad news is that a fix only protects you once it's actually installed.
“Ok, so what exactly did Zoom fix?”
Zoom patched two separate vulnerabilities, both in Zoom Workplace for Windows:
CVE-2026-108186 (Critical, 9.6 out of 10) is an improper input validation flaw. In plain terms, the app didn't properly check data it received before acting on it. It affects versions 7.1.0 up to, but not including, 7.1.8. Zoom's own offensive security team found it.
CVE-2026-108187 (High, 8.1 out of 10) is an origin validation error. The app didn't properly confirm where a request came from before trusting it. It affects all versions before 7.1.5, and an outside researcher reported it to Zoom.
Both flaws could let an unauthenticated user “escalate privileges” over the network. That's a technical way of saying a hacker could start with no access and end up with much deeper access than they should have. The impact could reach as far as stealing data or installing malware, though Zoom hasn't published technical details.
“Should I be worried that hackers are already using these?”
Not yet. Zoom says it isn't aware of anyone exploiting either flaw. Zoom’s scoring also shows that both flaws require some kind of user interaction. A hacker can't just flip a switch. Someone has to do something first, though Zoom hasn't said exactly what.
But “not yet” has a short shelf life. Once a patch is public, hackers can compare the old and new versions to figure out what changed. Zoom is also a popular target. In July, Zoom fixed a critical account takeover flaw. In August, it patched a critical zero-click flaw nicknamed “Zoomsday.” In October, it published four more high-severity bulletins. That's a steady drumbeat of serious fixes.
“Ok, I'm convinced. How do I make sure we're protected?”
Updating takes a few minutes. Making sure it happens everywhere takes a little planning. Here's where to start:
Update to the latest version. On a single computer, open Zoom Workplace, click your profile picture, and select “Check for Updates.” You can also grab it from Zoom's official download page. Version 7.1.8 or newer covers both flaws.
Don't rely on people to do it themselves. If you manage computers centrally, push the update through your device management tool and turn on automatic updates. Then confirm every Windows computer actually took it.
Look for the stragglers. Shared conference room PCs, laptops that rarely connect to the IT network, and forgotten installs are easy to miss. Those are exactly the ones hackers hope you overlooked.
Treat “critical” as a deadline. Set a timeframe for applying critical patches, like within a few days of release. Then apply that timeframe to every app, along with Windows.
“Why does one app update matter this much?”
Because every app on a computer is a possible way in. We've said it before in another ACT post: if your devices aren't updated, you're in for a bad time. That applies to the apps people use every day, as well as the operating system. Video conferencing tools sit on nearly every computer and talk to the internet all day. That makes them an attractive target, and keeping them current is one of the simplest ways to reduce your risk.
The hard part is knowing whether it landed on every device. Our vulnerability assessments find the outdated software and missed patches hiding across your IT network, so you can fix them before hackers find them.
Not sure every computer got the update?
Follow us - stay ahead.
