Is CVE-2026-30903 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30903 being exploited in the wild.

How severe is CVE-2026-30903?

Critical severity, with a CVSS score of 9.6, published 11 March 2026.

Which products and versions are affected?

Zoom Workplace for Windows before 6.6.0; Zoom Workplace VDI Client for Windows before 6.4.17, 6.5.15, and 6.6.10.

Is there a fix for CVE-2026-30903?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-30903 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-30903?

Check whether you run Zoom Workplace for Windows or Zoom Workplace VDI Client for Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30903: Zoom Workplace privilege escalation in Mail feature

CVE-2026-30903 · Severity: critical · CVSS 9.6 · Published 2026-03-11

Zoom Workplace for Windows, a popular business communication and collaboration platform, contains a critical security flaw in its Mail feature. An attacker could exploit this vulnerability to gain unauthorized elevated permissions on a user's computer. This could lead to full system compromise, unauthorized access to sensitive corporate data, or the ability to install malicious software.

Technologies: Zoom Workplace for Windows, Zoom Workplace VDI Client for Windows. Vendors: Zoom.

Quick answers

Is CVE-2026-30903 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30903 being exploited in the wild.
How severe is CVE-2026-30903?: Critical severity, with a CVSS score of 9.6, published 11 March 2026.
Which products and versions are affected?: Zoom Workplace for Windows before 6.6.0; Zoom Workplace VDI Client for Windows before 6.4.17, 6.5.15, and 6.6.10.
Is there a fix for CVE-2026-30903?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-30903 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-30903?: Check whether you run Zoom Workplace for Windows or Zoom Workplace VDI Client for Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as External Control of File Name or Path (CWE-73/CWE-610) exists in the Mail component of Zoom Workplace for Windows. The flaw allows an unauthenticated remote attacker to manipulate file paths or names, leading to an escalation of privilege. While the attack vector is network-based, the CVSS vector indicates that some level of user interaction is required (UI:R) and that the vulnerability can impact components beyond the initial security scope (S:C). Attackers can leverage this to gain higher-level system permissions. The issue is resolved in Zoom Workplace for Windows version 6.6.0 and various VDI client patches (6.4.17, 6.5.15, and 6.6.10).

Affected products

Zoom Workplace for Windows before 6.6.0
Zoom Workplace VDI Client for Windows before 6.4.17, 6.5.15, and 6.6.10

Timeline

2026-03-10: advisory: Initial publication of Zoom security bulletin ZSB-26005
2026-03-11: disclosed: CVE-2026-30903 published

References

https://www.zoom.com/en/trust/security-bulletin/zsb-26005

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.