Hackers could exploit Zoom to take control of Windows PCs
No password needed. Windows users at risk.
Image by Cybernews
Follow us
- Zoom patched a critical Windows vulnerability in Zoom Workplace versions 7.1.0 through 7.1.7.
- The flaw could let attackers gain higher system privileges and access sensitive local data.
- Users should update Zoom Workplace for Windows to version 7.1.8 or later.
- Zoom says it has not seen attackers exploit the vulnerability in the wild.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Zoom fixes a critical Windows flaw that could allow attackers to take over the system.
Zoom urges users to update the software after a new flaw was discovered in Zoom Workplace for Windows. Tracked as CVE-2026-108186, the critical vulnerability carries a CVSS score of 9.6 out of 10.
Zoom serves around 192,400 enterprise customers and generates approximately $4.8 billion in annual revenue. At its peak, the platform reported 300 million daily meeting participants.
The company disclosed the critical security issue on November 10th, warning that attackers might not need to hack a user's Zoom account to exploit the vulnerability, as it resides within the Windows application itself.
When Zoom Workplace is installed, the application runs on the computer and communicates with Zoom's servers over the internet. It also interacts with Windows to access system resources such as the microphone, camera, and files.
Like other desktop applications, Zoom processes incoming information and performs operations based on that data. However, Zoom may fail to properly validate certain information it processes.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The discovered flaw leaves Zoom without proper data verification, potentially allowing an attacker to send corrupted input to gain elevated privileges on the affected system.
This means that if an attacker creates and delivers specially crafted data over the network that triggers the vulnerability, and the victim performs actions that allow the malicious input to be processed, the Zoom application may perform an operation with higher privileges than intended.
This could allow attackers to access locally stored sensitive information, potentially including authentication tokens or credentials.
Additionally, attackers could abuse elevated privileges to access other applications or accounts on the compromised device. They could modify files, change system settings, install malicious software, or disrupt normal computer operations.
The vulnerability affects Zoom Workplace for Windows versions 7.1.0 through 7.1.7. Users are urged to update their application to version 7.1.8 or later to fix the issue.
Zoom has not reported any exploitation of the vulnerability in the wild.
These updates follow major patches released for the videoconferencing application over the summer. The critical vulnerability patched in July allowed online attackers to tamper with Zoom traffic and hijack accounts without requiring passwords or user interaction.
In August, Zoom patched four vulnerabilities, including a critical zero-click flaw that could allow a meeting participant to execute code on another participant's computer.
