Is CVE-2026-30902 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30902 being exploited in the wild.

How severe is CVE-2026-30902?

High severity, with a CVSS score of 7.8, published 11 March 2026.

Which products and versions are affected?

Zoom Rooms before 6.6.0; Zoom Workplace before 6.6.0; Zoom Workplace VDI Client before 6.4.15, 6.5.13, and 6.6.10.

Is there a fix for CVE-2026-30902?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-30902 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-30902?

Check whether you run Zoom Rooms, Zoom Workplace or Zoom Workplace VDI Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30902: Zoom Clients for Windows privilege escalation

CVE-2026-30902 · Severity: high · CVSS 7.8 · Published 2026-03-11

A security vulnerability in Zoom's Windows applications could allow a user who already has basic access to a computer to gain higher-level system permissions. This could potentially allow an unauthorized individual to bypass security controls, access sensitive data, or modify system settings on the affected machine. The issue affects Zoom Workplace, Zoom Rooms, and Zoom VDI clients running on Windows.

Technologies: Zoom Rooms, Zoom Workplace, Zoom Workplace VDI Client. Vendors: Zoom.

Quick answers

Is CVE-2026-30902 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30902 being exploited in the wild.
How severe is CVE-2026-30902?: High severity, with a CVSS score of 7.8, published 11 March 2026.
Which products and versions are affected?: Zoom Rooms before 6.6.0; Zoom Workplace before 6.6.0; Zoom Workplace VDI Client before 6.4.15, 6.5.13, and 6.6.10.
Is there a fix for CVE-2026-30902?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-30902 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-30902?: Check whether you run Zoom Rooms, Zoom Workplace or Zoom Workplace VDI Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper privilege management vulnerability (CWE-269) exists in several Zoom clients for Windows, including Workplace, Rooms, and VDI versions. The flaw allows a locally authenticated user with low privileges to escalate their permissions on the host operating system. The vulnerability is triggered via local access and does not require user interaction. Successful exploitation grants the attacker high-level access (System/Admin), potentially leading to full compromise of the local machine's confidentiality, integrity, and availability. Zoom has released updates to address this in Workplace/Rooms version 6.6.0 and various VDI branch updates.

Affected products

Zoom Workplace for Windows before 6.6.0
Zoom Workplace VDI Client for Windows before 6.4.15, 6.5.13, and 6.6.10
Zoom Rooms for Windows before 6.6.0

Timeline

2026-03-10: disclosed: Initial publication of security bulletin ZSB-26004
2026-03-11: advisory: NVD publication date

References

https://www.zoom.com/en/trust/security-bulletin/zsb-26004

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.