Author: Merrel Briona

Zoom published security bulletins ZSB-26023 and ZSB-26024, dated 10 November 2026, for Zoom Workplace for Windows. ZSB-26023 covers CVE-2026-108186, which Zoom rates Critical (CVSS 3.1 9.6): “Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.” ZSB-26024 covers CVE-2026-108187, which Zoom rates High (CVSS 3.1 8.1): “Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.” Zoom’s published vectors for both require user interaction (UI:R).

Both bulletins give the same remediation: “Users can help keep themselves secure by applying the latest updates available at For CVE-2026-108186, Zoom lists “Zoom Workplace for Windows starting on version 7.1.0 and before version 7.1.8.” For CVE-2026-108187, Zoom lists “Zoom Workplace for Windows before version 7.1.5,” with no lower bound. Version 7.1.8 and later sit outside both affected ranges; 7.1.5 through 7.1.7 sit outside the CVE-2026-108187 range but inside the CVE-2026-108186 range.

Zoom’s bulletin pages do not discuss exploitation. CVE-2026-108186 and CVE-2026-108187 are not in CISA KEV as of catalogVersion 2026.11.10, checked 11 November 2026 at 19:21 Asia/Jerusalem UTC+2. This post makes no exploitation claim.

Technical Information

CVE-2026-108186 (ZSB-26023). Zoom rates it Critical, CVSS 3.1 9.6, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H: reachable over the network with no privileges required, but requiring user interaction (UI:R), with changed scope (S:C). Zoom’s CVE record lists CWE-20 (Improper Input Validation). The bulletin credits “Zoom Offensive Security.”

CVE-2026-108187 (ZSB-26024). Zoom rates it High, CVSS 3.1 8.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N: also requiring user interaction (UI:R), with unchanged scope and no availability impact. Zoom’s CVE record lists CWE-346 (Origin Validation Error). The bulletin credits “shmoul.”

What the bulletins do not say. Neither bulletin describes the exploit path, what the required user interaction is, or which privilege level an attacker could reach. This post does not fill those gaps. NVD republishes Zoom’s vectors as metric type Secondary and lists both records as Awaiting Analysis.

CVE record encoding. For CVE-2026-108186, Zoom’s CVE record encodes “Zoom Workplace” on Windows as affected from version 7.1 up to but not including 7.1.8. The bulletin’s wording, “starting on version 7.1.0 and before version 7.1.8,” is more specific, and this post follows it. For CVE-2026-108187, the record encodes 0 up to but not including 7.1.5, matching the bulletin.

Affected Product Versions

From Zoom’s bulletins. Zoom does not list macOS, Linux, mobile, Zoom Rooms or VDI clients on these bulletins, and this post does not extend the scope.

Product	Bulletin / CVE	Affected, as Zoom states	Outside that range
Zoom Workplace for Windows	ZSB-26023 / CVE-2026-108186	starting on version 7.1.0 and before version 7.1.8	7.1.8 and later
Zoom Workplace for Windows	ZSB-26024 / CVE-2026-108187	before version 7.1.5 (no lower bound stated)	7.1.5 and later

Zoom’s remediation is the latest update from When confirming a fleet, a Windows client on 7.1.8 or later is outside both affected ranges. Each bulletin is revision 1.0, dated 11/10/2026, “Initial publication,” and Zoom’s index showed no later revision at the 19:21 recheck.

Exploitation Status

Zoom’s ZSB-26023 and ZSB-26024 pages do not discuss exploitation, customer impact or proof-of-concept code. CISA-ADP’s SSVC entries on both CVE records set Exploitation to “none” and Automatable to “no”; that is CISA-ADP’s assessment, not a KEV listing. Neither CVE was in CISA KEV at the 19:21 check. This post makes no exploitation claim.

Workaround and Mitigation

Neither bulletin lists a workaround or compensating control. Zoom’s guidance is to apply the latest updates available at A Windows client below 7.1.8 remains in scope for at least CVE-2026-108186.

Indicators of Compromise

Zoom’s bulletins publish no indicators of compromise or detection guidance for these CVEs, and this post does not supply any.

What to Ask Your Suppliers and MSPs Today

Zoom Workplace for Windows runs on the laptops of suppliers’ and MSPs’ staff, including people who work inside your environment or join your meetings. Both vectors require user interaction, and Zoom does not say what that interaction is, so staff who routinely open meeting links and invitations from outside parties are a sensible group to update first. Ask suppliers that manage Windows endpoints, or whose staff use Zoom with you, in writing:

• Whether their Windows fleets are on Zoom’s latest update, confirmed as 7.1.8 or later, which is outside both affected ranges.
• How they enforce Zoom client updates, including update rings, group-policy holds or offline installers that could leave endpoints between 7.1.0 and versions before 7.1.8.
• When lagging endpoints will be updated, and how they will confirm the running client version afterwards.

If you manage the Windows client yourself, apply Zoom’s latest update from the official download page first, then confirm the same points against your inventory.

If your team needs help reviewing which suppliers manage Zoom Workplace for Windows and whether those fleets are on 7.1.8 or later, Talk to an expert.

Sources

• ZSB-26023 — Zoom Workplace for Windows – Improper Input Validation, Zoom, revision 1.0 dated 11/10/2026; CVE-2026-108186, Zoom rating Critical 9.6. Rechecked 11 November 2026 at 19:21 Asia/Jerusalem UTC+2.
• ZSB-26024 — Zoom Workplace for Windows – Origin Validation Error, Zoom, revision 1.0 dated 11/10/2026; CVE-2026-108187, Zoom rating High 8.1. Rechecked 11 November 2026 at 19:21 Asia/Jerusalem UTC+2.
• Zoom Security Bulletins index, Date Published and Date Updated 11/10/2026 for both bulletins.
• CVE-2026-108186 and NVD — Zoom CNA, CVSS 3.1 9.6, CWE-20; NVD Awaiting Analysis, metric Secondary; CISA-ADP SSVC Exploitation none.
• CVE-2026-108187 and NVD — Zoom CNA, CVSS 3.1 8.1, CWE-346; NVD Awaiting Analysis, metric Secondary; CISA-ADP SSVC Exploitation none.
• CISA catalog JSON feed — catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29Z; CVE-2026-108186 and CVE-2026-108187 are not in CISA KEV as of 11 November 2026 at 19:21 Asia/Jerusalem UTC+2.
• The Hacker News, 11 November 2026 — secondary coverage; scores and version ranges match Zoom’s bulletins.

• Adobe (NasdaqGS:ADBE) expanded its partnership with Google to deepen AI integrations across Google Workspace and Adobe platforms.
• Acrobat and other Adobe services are being embedded directly into Google Workspace, with Gemini models feeding tools like Firefly and Photoshop.
• Adobe introduced new AI features including Creative Cloud AI agents, Firefly Design in beta, and intelligent workflow automation across its suite.
• The wider impact of the Adobe Google AI integrations and new agentic tools becomes clearer when set against broader trends uncovered in our research. Our analysis turns up 1 warning sign for Adobe as well.

This push into connected AI workflows is not limited to Adobe and Google, and other stocks linked to this theme appear in 53 AI infrastructure stocks.

Adobe operates as a global software provider focused on creative, document, and experience tools. Deeper AI hooks into Google products plug directly into the workflows many designers and knowledge workers already use. That reach gives the business a wide testing ground for its generative AI and agent features across everyday content creation.

4 things going right for Adobe that this headline doesn’t cover.

How the Google partnership plugs into Adobe’s AI investment story

Adobe’s Narrative hinges on turning a huge free user base and early AI spending into durable subscription-style revenue. The expanded Google partnership goes straight at that bet by putting Acrobat, Firefly and Creative Cloud agents inside the productivity tools and AI surfaces billions of people already touch.

“The freemium funnel that has taken Adobe to more than 1 billion total monthly active users and over 100 million creative freemium users, both growing strongly, gives the company a large pool of potential converts that can help rebuild net new ARR growth and support future revenue…”

See how the full story points towards a $268 fair value for Adobe.

This deal leans into the Narrative’s strongest catalyst, AI-first products embedded where work actually happens. Tighter hooks into Google Workspace and Gemini give Adobe more surface area to convert casual Firefly use into paid workflows, which lines up with the focus on AI-first ARR and CX Enterprise style partnerships.

The unresolved piece is conversion quality, not reach. Nothing in this news answers whether these extra entry points convert free activity into paying teams fast enough to offset slower net-new ARR or rising competition from players like Canva and Microsoft. That is the single execution risk analysts keep circling around this AI story.

Raw headlines like this only become useful when you map them back to a clear Narrative about how Adobe earns, competes and turns product launches into long-term cash flow.

The last check on Adobe that serious buyers run

Before acting on any story around Adobe, many investors step back and ask what the stream of future cash the business produces might justify as a fair price, then compare that with where the shares trade today. Find out exactly what Adobe is worth today based on its cash flows.

Have feedback on this article? Concerned about the content? Get in touch with us directly. Alternatively, email editorial-team@simplywallst.com