CVE-2026-108186: Critical Zoom Workplace for Windows Vulnerability — Detection and Remediation Guide

---
title: Zoom Workplace Suspicious Child Process Execution
id: 8a7b9c1d-2e3f-4a5b-8c9d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious child processes spawned by Zoom Workplace for Windows, potentially indicating exploitation of CVE-2026-108186 leading to privilege escalation.
references:
  - https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\Zoom.exe'
      - '\Zoom.exe.tmp'
      - '\CptHost.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\wmic.exe'
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\systeminfo.exe'
  condition: selection
falsepositives:
  - Legitimate Zoom updates may spawn installer processes
  - IT administrative scripts executed via Zoom chat (rare)
level: high
---
title: Zoom Process Execution from Unusual Directory
id: 9b8c7d6e-5f4a-3b2c-1d9e-8f7a6b5c4d3e
status: experimental
description: Detects execution of Zoom binaries from non-standard installation directories, which may indicate a malicious payload masquerading as Zoom or an attempt to execute a compromised binary from a temp location.
references:
  - https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - 'Zoom.exe'
      - 'CptHost.exe'
    Image|not_contains:
      - ':\\Program Files\\Zoom\\'
      - ':\\Program Files (x86)\\Zoom\\'
      - ':\\Users\\*\\AppData\\Roaming\\Zoom\\'
  condition: selection
falsepositives:
  - Portable installations (rare in enterprise)
  - Developer testing environments
level: medium
---
title: Zoom Network Connection to Suspicious External IP
id: 7c6d5e4f-3a2b-1c9d-8e7f-6a5b4c3d2e1f
status: experimental
description: Detects Zoom processes establishing network connections to rare or known-bad external IP addresses, potentially indicating C2 communication following exploitation.
references:
  - https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\Zoom.exe'
      - '\CptHost.exe'
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
    DestinationIp|not_cidr:
      - '224.0.0.0/4'
      - '239.0.0.0/8'
  condition: selection
falsepositives:
  - Zoom traffic to private relay servers (verify internal Zoom infrastructure)
  - Split-tunnel VPN configurations
level: medium

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "Zoom.exe" or InitiatingProcessFileName =~ "CptHost.exe"
| where FileName in~ (
    "cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", 
    "regsvr32.exe", "mshta.exe", "wscript.exe", "cscript.exe",
    "wmic.exe", "sc.exe", "net.exe", "net1.exe", "whoami.exe",
    "systeminfo.exe", "nltest.exe", "dsquery.exe"
)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, 
          FileName, ProcessCommandLine, SHA256, FolderPath
| order by TimeGenerated desc

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "Zoom.exe" or FileName =~ "CptHost.exe"
| where FolderPath !contains "Program Files" 
    and FolderPath !contains "AppData\\Roaming\\Zoom"
    and FolderPath !contains "Downloads"
| project TimeGenerated, DeviceName, AccountName, FileName, 
          FolderPath, ProcessCommandLine, SHA256
| order by TimeGenerated desc

DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "Zoom.exe" or InitiatingProcessFileName =~ "CptHost.exe"
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| where RemoteIP !contains "zoom.us" and RemoteIP !contains "cloudfront.net" // Add known Zoom CDN ranges if available
| summarize ConnectionCount = count(), DistinctIPs = dcount(RemoteIP) by DeviceName, AccountName, RemoteIP, RemotePort
| where DistinctIPs > 5 or ConnectionCount > 100
| order by ConnectionCount desc

-- Hunt for Zoom processes spawning suspicious child processes (Privilege Escalation Indicators)
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    ParentPid,
    (SELECT Name FROM pslist(pid=ParentPid)) as ParentName,
    (SELECT Exe FROM pslist(pid=ParentPid)) as ParentPath
FROM pslist()
WHERE (ParentName =~ '(?i)Zoom\.exe|CptHost\.exe')
  AND (Name =~ '(?i)cmd\.exe|powershell\.exe|pwsh\.exe|rundll32\.exe|regsvr32\.exe|mshta\.exe|wscript\.exe|cscript\.exe|wmic\.exe|sc\.exe|net\.exe|net1\.exe|whoami\.exe|systeminfo\.exe')
ORDER BY CreateTime DESC

-- Enumerate all running Zoom processes and check their installation paths
SELECT 
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime
FROM pslist()
WHERE Name =~ '(?i)Zoom\.exe|CptHost\.exe'
  AND NOT Exe =~ '(?i)Program Files|AppData\\\\Roaming\\\\Zoom'

# Zoom Workplace CVE-2026-108186 Detection and Remediation Verification Script
# Run with administrative privileges

$ErrorActionPreference = "SilentlyContinue"

function Get-ZoomInstallations {
    $zoomPaths = @()
    
    # Standard installation paths
    $paths = @(
        "${env:ProgramFiles}\Zoom\bin\Zoom.exe",
        "${env:ProgramFiles(x86)}\Zoom\bin\Zoom.exe",
        "${env:LOCALAPPDATA}\Zoom\bin\Zoom.exe",
        "${env:APPDATA}\Zoom\bin\Zoom.exe"
    )
    
    foreach ($path in $paths) {
        if (Test-Path $path) {
            $zoomPaths += $path
        }
    }
    
    # Also check registry for uninstall strings to find non-standard installs
    $uninstallKeys = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
        "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*",
        "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"
    )
    
    foreach ($keyPath in $uninstallKeys) {
        $keys = Get-ItemProperty $keyPath | Where-Object { $_.DisplayName -like "*Zoom*" }
        foreach ($key in $keys) {
            if ($key.InstallLocation) {
                $potentialPath = Join-Path $key.InstallLocation "bin\Zoom.exe"
                if (Test-Path $potentialPath) {
                    $zoomPaths += $potentialPath
                }
            }
        }
    }
    
    return $zoomPaths | Select-Object -Unique
}

function Get-FileVersionInfo {
    param($FilePath)
    try {
        $versionInfo = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($FilePath)
        return @{
            Path = $FilePath
            Version = $versionInfo.FileVersion
            ProductVersion = $versionInfo.ProductVersion
            IsVulnerable = $false  # Will be set based on version check
        }
    } catch {
        return @{
            Path = $FilePath
            Version = "Unknown"
            ProductVersion = "Unknown"
            IsVulnerable = $true
        }
    }
}

# Main execution
Write-Host "[+] Scanning for Zoom Workplace installations..." -ForegroundColor Cyan
$installations = Get-ZoomInstallations

if ($installations.Count -eq 0) {
    Write-Host "[-] No Zoom installations found on this system." -ForegroundColor Yellow
    exit 0
}

Write-Host "[+] Found $($installations.Count) Zoom installation(s):" -ForegroundColor Green

$vulnerableSystems = @()
$patchedSystems = @()

foreach ($install in $installations) {
    $info = Get-FileVersionInfo -FilePath $install
    
    # Version check - Note: Replace with actual patched version when Zoom releases specific version info
    # For now, flag all versions for manual verification or check for latest update date
    $fileInfo = Get-Item $install
    $lastWrite = $fileInfo.LastWriteTime
    $daysSinceUpdate = (New-TimeSpan -Start $lastWrite -End (Get-Date)).Days
    
    # If Zoom hasn't been updated in the last 7 days, flag it as potentially vulnerable
    if ($daysSinceUpdate -gt 7) {
        $info.IsVulnerable = $true
        $vulnerableSystems += $info
        Write-Host "  [!] VULNERABLE: $($info.Path) - Version: $($info.Version), Last Updated: $lastWrite" -ForegroundColor Red
    } else {
        $patchedSystems += $info
        Write-Host "  [+] Recently Updated: $($info.Path) - Version: $($info.Version), Last Updated: $lastWrite" -ForegroundColor Green
    }
}

# Check for suspicious child processes (requires admin)
Write-Host "`n[+] Checking for suspicious Zoom child processes (last 24 hours)..." -ForegroundColor Cyan
$suspiciousParents = @("Zoom.exe", "CptHost.exe")
$suspiciousChildren = @("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe")

$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-1)} | 
    Where-Object { $_.Message -match ($suspiciousParents -join "|") }

if ($events) {
    Write-Host "  [!] Found potential suspicious process execution events. Review Security Event Log 4688 for details." -ForegroundColor Red
} else {
    Write-Host "  [+] No suspicious child processes detected in last 24 hours." -ForegroundColor Green
}

# Summary and Remediation Recommendations
Write-Host "`n[+] SUMMARY" -ForegroundColor Cyan
Write-Host "  Total Zoom Installations: $($installations.Count)" -ForegroundColor White
Write-Host "  Potentially Vulnerable: $($vulnerableSystems.Count)" -ForegroundColor $(if ($vulnerableSystems.Count -gt 0) { "Red" } else { "Green" })
Write-Host "  Recently Updated: $($patchedSystems.Count)" -ForegroundColor Green

if ($vulnerableSystems.Count -gt 0) {
    Write-Host "`n[!] ACTION REQUIRED: Update Zoom Workplace immediately to the latest version." -ForegroundColor Red
    Write-Host "    Download from: https://zoom.us/download" -ForegroundColor Yellow
    Write-Host "    Or deploy via enterprise software management tools." -ForegroundColor Yellow
}

# Check if auto-update is enabled (registry check)
$autoUpdatePath = "HKLM:\SOFTWARE\Policies\Zoom\Zoom Meetings\General"
$autoUpdateEnabled = Get-ItemProperty -Path $autoUpdatePath -Name "EnableAutoUpdate" -ErrorAction SilentlyContinue

if (-not $autoUpdateEnabled) {
    Write-Host "`n[!] WARNING: Zoom Auto-Update policy not enforced via Group Policy." -ForegroundColor Yellow
    Write-Host "    Consider enabling: Computer Configuration > Administrative Templates > Zoom > General > Enable Auto Update" -ForegroundColor Yellow
}

Write-Host "`n[+] Script execution completed." -ForegroundColor Cyan