Asus router firmware flaws; Zoom Workplace for Windows privilege escalation (CVE-2026-108186)
Severity: critical · Patch status: patched · Since 2026-11-11 · CVE-2026-108186, CVE-2026-108187
Zoom patched two privilege escalation vulnerabilities in Zoom Workplace for Windows, including a critical unauthenticated bug CVE-2026-108186 (CVSS 9.6) and CVE-2026-108187 (CVSS 8.1), both remotely exploitable by unauthenticated attackers; fixes ship in version 7.1.8 and later, with no exploitation reported. Asus released an advisory covering four high- and medium-severity flaws in certain router firmware that could allow arbitrary command execution with root privileges or memory overwrites causing crashes. Cisco updated advisories on Node2Shell impact, an ISE/ISE-PIC authorization bypass, and Meraki fixes for seven critical/high CVEs. Cisco and SonicWall also removed root certificates affected by compromised eMudhra intermediate CAs. These updates arrived alongside hundreds of patches from Apple, Microsoft, Fortinet, Ivanti, Intel, AMD and others.
What to do
- Update Zoom Workplace for Windows to 7.1.8 or later immediately
- Apply Asus router firmware updates for affected models
- Review Cisco advisories and apply Meraki, ISE/ISE-PIC and Node2Shell-related fixes
- Verify trust stores no longer include the compromised eMudhra intermediate certificates on Cisco and SonicWall devices
- Check vendor advisories from this patch cycle (Apple, Microsoft, Fortinet, Ivanti, Intel, AMD, Adobe, SAP) for products in use
Fixed versions
- Zoom Workplace for Windows 7.1.8+
Sources
All live incidents on Threat Watch
