Critical severity · published Mar 11, 2026
CVE-2026-30903
External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via…
9.8
CVSS
0.3%
EPSS
No
On KEV
Description
External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZW
Zoom Workplace · Zoom Communications
see references · source: vendor
WD
Workplace Desktop · Zoom
before 6.6.0 · source: NVD
WV
Workplace Virtual Desktop Infrastructure · Zoom
6.4.0 before 6.4.17; 6.5.0 before 6.5.15; 6.6.0 before 6.6.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-30903
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-30903
Vendor Advisory
https://www.zoom.com/en/trust/security-bulletin/zsb-26005
More from Zoom Workplace
9.8
CVE-2026-53407
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an…
8.1
CVE-2026-53418
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege…
8.1
CVE-2026-53408
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an…
8.0
CVE-2026-53420
Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access
4.3
CVE-2026-30904
Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical access