Is CVE-2026-108184 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108184 being exploited in the wild.

How severe is CVE-2026-108184?

High severity, with a CVSS score of 7.4, published 13 October 2026.

Which products and versions are affected?

Zoom Rooms for Windows 7.0.0 to before 7.1.7; Zoom Workplace for Windows 7.0.0 to before 7.1.9 and 7.2.0; Zoom Workplace VDI Client for Windows 7.0.11 to before 7.0.13.

Is there a fix for CVE-2026-108184?

Yes: fixed in Zoom Workplace for Windows 7.1.9 and 7.2.0; Zoom Workplace VDI Client for Windows 7.0.13; Zoom Rooms for Windows 7.1.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108184 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108184?

Check whether you run Zoom Rooms for Windows, Zoom Workplace for Windows or Zoom Workplace VDI Client for Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108184: Zoom Clients for Windows improper certificate validation

CVE-2026-108184 · Severity: high · CVSS 7.4 · Published 2026-10-13

Zoom Clients for Windows contain a flaw in certificate validation that allows an unauthenticated attacker to intercept and read sensitive data transmitted over the network. An attacker can exploit this vulnerability without user interaction by performing a man-in-the-middle attack on network communications. This could lead to exposure of meeting data, credentials, or other confidential information.

Technologies: Zoom Workplace for Windows, Zoom Workplace VDI Client for Windows. Vendors: Zoom.

Quick answers

Is CVE-2026-108184 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108184 being exploited in the wild.
How severe is CVE-2026-108184?: High severity, with a CVSS score of 7.4, published 13 October 2026.
Which products and versions are affected?: Zoom Rooms for Windows 7.0.0 to before 7.1.7; Zoom Workplace for Windows 7.0.0 to before 7.1.9 and 7.2.0; Zoom Workplace VDI Client for Windows 7.0.11 to before 7.0.13.
Is there a fix for CVE-2026-108184?: Yes: fixed in Zoom Workplace for Windows 7.1.9 and 7.2.0; Zoom Workplace VDI Client for Windows 7.0.13; Zoom Rooms for Windows 7.1.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108184 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108184?: Check whether you run Zoom Rooms for Windows, Zoom Workplace for Windows or Zoom Workplace VDI Client for Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Zoom Workplace for Windows 7.1.9 and 7.2.0; Zoom Workplace VDI Client for Windows 7.0.13; Zoom Rooms for Windows 7.1.7

Technical details

Improper certificate validation in Zoom Clients for Windows allows an unauthenticated network attacker to conduct man-in-the-middle attacks and achieve information disclosure. The vulnerability affects multiple Zoom products with high-complexity attack conditions (AC:H) but requires no user interaction. A fix is available in patched versions for each affected product.

Affected products

Zoom Zoom Workplace for Windows 7.0.0 to before 7.1.9 and 7.2.0
Zoom Zoom Workplace VDI Client for Windows 7.0.11 to before 7.0.13
Zoom Zoom Rooms for Windows 7.0.0 to before 7.1.7

Timeline

2026-10-13: disclosed

References

https://www.zoom.com/en/trust/security-bulletin/zsb-26021

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.