{"id":"CVE-2026-108186","published":"2026-11-10T16:17:14.183","lastModified":"2026-11-11T05:19:16.987","description":"Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://www.zoom.com/en/trust/security-bulletin/zsb-26023","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Zoom Workplace for Windows contains improper input validation (CWE-20) that allows an unauthenticated attacker over the network to escalate privileges on the host system. This is critical due to the high confidentiality, integrity, and availability impact.","exploitability":"Exploitation requires network access and user interaction (e.g.,诱使用户 open a malicious link or file), but no authentication or prior access is needed.","blast_radius":"Successful exploitation could allow full compromise of the affected Zoom Workplace client, including unauthorized access to user data, session hijacking, or execution of arbitrary code with elevated privileges.","remediation":"Upgrade to Zoom Workplace for Windows version 2.590 or later, as this is the fixed version addressing CVE-2026-108186.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","input-validation","windows","zoom"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:55:10.722Z"}}