CVE-2026-30901: Zoom Rooms for Windows privilege escalation in Kiosk Mode

CVE-2026-30901 · Severity: high · CVSS 7 · Published 2026-03-11

Zoom Rooms for Windows, a software solution used to manage conference room hardware, contains a security flaw when running in Kiosk Mode. An individual with physical or local access to the computer can exploit this vulnerability to gain higher-level system permissions. This could allow an unauthorized user to bypass security restrictions, access sensitive data, or compromise the underlying operating system.

Technologies: Zoom Rooms. Vendors: Zoom.

Quick answers

Is CVE-2026-30901 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-30901 being exploited in the wild.
How severe is CVE-2026-30901?
High severity, with a CVSS score of 7, published 11 March 2026.
Which products and versions are affected?
Zoom Rooms before 6.6.5.
Is there a fix for CVE-2026-30901?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-30901 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-30901?
Check whether you run Zoom Rooms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in Zoom Rooms for Windows (versions prior to 6.6.5) specifically when the application is operating in Kiosk Mode. The flaw stems from improper input validation (CWE-20), which can be leveraged by a locally authenticated user. While the attack requires local access and faces high complexity (AC:H), a successful exploit allows the attacker to gain elevated permissions on the host Windows system. Zoom has addressed this issue in version 6.6.5.

Affected products

  • Zoom Rooms before 6.6.5

Timeline

  • 2026-03-10: advisory: Zoom security bulletin ZSB-26003 published
  • 2026-03-11: disclosed: CVE-2026-30901 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.