CVE-2026-30903 is a critical flaw (CVSS 9.6) in the Mail feature of Zoom Workplace for Windows before 6.6.0. External control of a file name or path may allow privilege escalation over the network. Update to Zoom Workplace 6.6.0 or later.
What's affected
Per Zoom bulletin ZSB-26005, affected products are Zoom Workplace for Windows before version 6.6.0, and the Zoom Workplace VDI Client for Windows before versions 6.4.17, 6.5.15 and 6.6.10 in their respective branches.
How to check if you're exposed
In the Zoom app, open your profile menu and choose the About option to read the installed version. For a fleet, query your endpoint management tool for the Zoom Workplace version and flag anything below 6.6.0.
VDI deployments need a separate check of the VDI client version against the branch numbers above.
What to do now
- Update Zoom Workplace for Windows to 6.6.0 or later from the official download page.
- Update the VDI client to 6.4.17, 6.5.15 or 6.6.10 depending on your branch.
- Confirm that auto update is working on managed machines.
- If your organization does not use the Mail feature, ask your Zoom administrator whether it can be turned off until patching finishes.
Why it matters
The weakness classes are CWE-610, externally controlled reference to a resource, and CWE-73, external control of file name or path. Data from outside decides which file or path the application touches.
Zoom's bulletin says the issue was reported by Zoom's own offensive security team. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and the bulletin gives no sign of exploitation.
Quick check
Is the macOS or mobile client affected?
The bulletin lists only Windows clients and the Windows VDI client.
Sources
Last reviewed: 19 October 2026.
