CVE-2026-108186

Summary

Zoom Workplace for Windows contains improper input validation (CWE-20) that allows an unauthenticated attacker over the network to escalate privileges on the host system. This is critical due to the high confidentiality, integrity, and availability impact.

Exploitability

Exploitation requires network access and user interaction (e.g.,诱使用户 open a malicious link or file), but no authentication or prior access is needed.

Blast radius

Successful exploitation could allow full compromise of the affected Zoom Workplace client, including unauthorized access to user data, session hijacking, or execution of arbitrary code with elevated privileges.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Zoom Workplace for Windows version 2.590 or later, as this is the fixed version addressing CVE-2026-108186.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.