Is CVE-2026-30906 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30906 being exploited in the wild.

How severe is CVE-2026-30906?

High severity, with a CVSS score of 7.8, published 13 May 2026.

Which products and versions are affected?

Zoom Rooms before version 7.0.0.

Is there a fix for CVE-2026-30906?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-30906 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-30906?

Check whether you run Zoom Rooms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30906: Zoom Rooms for Windows privilege escalation in installer

CVE-2026-30906 · Severity: high · CVSS 7.8 · Published 2026-05-13

A security vulnerability exists in the installer for Zoom Rooms for Windows, a software solution used to manage conference room hardware and meetings. An attacker with existing low-level access to a computer could exploit this flaw to gain higher-level administrative privileges. This could allow them to take full control of the system, potentially leading to unauthorized data access or persistent control over the conference room environment.

Technologies: Zoom Rooms. Vendors: Zoom.

Quick answers

Is CVE-2026-30906 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30906 being exploited in the wild.
How severe is CVE-2026-30906?: High severity, with a CVSS score of 7.8, published 13 May 2026.
Which products and versions are affected?: Zoom Rooms before version 7.0.0.
Is there a fix for CVE-2026-30906?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-30906 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-30906?: Check whether you run Zoom Rooms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An untrusted search path vulnerability (CWE-426) exists in the installer for Zoom Rooms for Windows prior to version 7.0.0. The flaw occurs because the installer may attempt to load resources or libraries from an insecure directory that can be modified by a standard user. A local, authenticated attacker can exploit this by placing a malicious file in the search path, which the installer then executes with elevated permissions. Successful exploitation allows a low-privileged user to gain full administrative rights on the affected Windows system. The issue is resolved in Zoom Rooms for Windows version 7.0.0.

Affected products

Zoom Rooms before version 7.0.0

Timeline

2026-05-12: advisory: Initial publication by Zoom (ZSB-26008)
2026-05-13: disclosed: NVD publication date

References

https://www.zoom.com/en/trust/security-bulletin/zsb-26008

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.