Two Zoom Workplace bugs could let remote attackers escalate privileges, while Asus router flaws could allow root-level command execution, even as vendors across the industry ship hundreds of fixes.
Zoom and Asus have released fresh security updates, adding to an already crowded patch cycle that saw fixes from some of the biggest names in technology.
Zoom patches two privilege-escalation flaws
Zoom has fixed two vulnerabilities in Zoom Workplace for Windows, one of them rated critical. The critical flaw, tracked as CVE-2026-108186, carries a CVSS score of 9.6 and allows privilege escalation without authentication. The second, CVE-2026-108187, scores 8.1 and could likewise let remote, unauthenticated attackers raise their privileges.
Zoom published both bulletins on November 10. Patches are included in Zoom Workplace for Windows version 7.1.8 and later, so users and administrators should update to that release or newer. Zoom’s advisories do not mention exploitation of either flaw in the wild.
Asus fixes router firmware bugs
Asus has published an advisory covering four high- and medium-severity vulnerabilities in certain router firmware releases. If exploited, the flaws could let attackers execute arbitrary commands with root privileges, or overwrite memory and crash the device. Owners should check their router model against the advisory and install the latest firmware.
Cisco and SonicWall deal with eMudhra fallout
Cisco also updated several of its existing advisories. It added fresh information about the impact of Node2Shell and of an authorisation bypass on its ISE and ISE-PIC products, and it published new details on the availability of fixes for seven critical- and high-severity CVEs in Meraki products.
On Tuesday, Cisco and SonicWall both said they had removed root certificates affected by the compromised eMudhra intermediate certificates. The certificates were blocked by browsers because their private keys could be recovered.
A crowded patch cycle
The updates landed alongside hundreds of fixes from other vendors, including Apple, Fortinet, Citrix, Ivanti, Intel, AMD, Microsoft, Adobe and SAP, as well as multiple industrial control system (ICS) vendors. Microsoft’s release included a patch for an exploited Outlook zero-day.
For security teams, the takeaway is practical. Prioritise internet-facing systems and routers, apply Zoom’s Windows update promptly, and review the advisories from the vendors you rely on.