CVE-2026-30903

critical · 9.6

External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.

9.6

CVSS

0.3%

EPSS (exploit prob.)

26th

EPSS percentile

2026-03-11

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-73CWE-610

Affected products

Vendor	Product	Affected versions
zoom	workplace_desktop	< 6.6.0
zoom	workplace_virtual_desktop_infrastructure	>= 6.4.0, < 6.4.17
zoom	workplace_virtual_desktop_infrastructure	>= 6.5.0, < 6.5.15
zoom	workplace_virtual_desktop_infrastructure	>= 6.6.0, < 6.6.10

Check a specific version with /api/v1/cve/match.

References

https://www.zoom.com/en/trust/security-bulletin/zsb-26005

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-30903