Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 (CVSS score: 9.6) - An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via
CVE-2026-119618 is a critical code execution flaw found in Apache HTTP Server's mod_http2 module. This vulnerability affects versions 2.4.55 through 2.4.70 and standalone mod_h2 from 2.0.8 through 2.0.42. An unauthenticated attacker with access to an HTTP/2-enabled server can exploit this flaw to take full control of the server process.
Apache HTTP Server developers have released version 2.4.71 to address the issue, but many downstream packages remain unfixed as of November 12. Debian stable, Amazon Linux, and Red Hat JBoss Core Services are among the affected distributions. To mitigate the vulnerability, Red Hat advises disabling HTTP/2 on servers that cannot be updated promptly.
The upstream patch is now available, but many organizations are still vulnerable until they apply the fix or disable HTTP/2.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
