Zoom's Windows app has a critical flaw rated 9.6 out of 10. Check your version before your next call

How long has it been since Zoom on your PC last updated? For plenty of people who only open it for the odd family call or a doctor's appointment, the honest answer is "no idea". This week that matters, because Zoom published two security bulletins on 10 November, and both concern the Windows app.

The serious one is CVE-2026-108186. Zoom rates it Critical, 9.6 out of a possible 10, and describes it in the dry language these notices always use: improper input validation that "may allow an unauthenticated user to conduct an escalation of privilege via network access". In plain terms, someone who isn't signed in and isn't sitting at your PC could gain rights on it that they shouldn't have. The score carries one small comfort: it assumes the victim has to do something first, such as clicking or opening something. The flaw affects Zoom Workplace for Windows from version 7.1.0 up to, but not including, 7.1.8, and Zoom's own security team found it. The second bug, CVE-2026-108187, is rated High at 8.1 and affects versions older than 7.1.5.

SecurityWeek, which reported the patches on Wednesday, points out that Zoom makes no mention of either flaw being used in real attacks. So there's no cause for alarm, only a reason not to leave it for weeks. Open Zoom, click your profile picture in the top right corner and choose Check for Updates. If the number you end up with is 7.1.8 or higher, you're covered for both. Neither bulletin names the Mac or phone versions.

Zoom is exactly the sort of program that sits unopened for a month and falls behind, and Tendvane's app update feature, which uses Windows' own winget tool, can bring it and your other installed apps up to date in one pass.