What is CVE-2026-30903?

CVE-2026-30903 is a critical-severity vulnerability in Zoom Workplace_desktop, classified under External Control of File Name or Path. CVSS score: 9.6/10. Published 2026-03-11.

How severe is CVE-2026-30903?

Critical severity. CVSS v3 base score is 9.6 out of 10.

Vulnerability in Zoom Workplace_desktop

CVE-2026-30903

External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.

EPSS: 0.001 (27.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

Affected products

Zoom Workplace_desktop
Zoom Workplace_virtual_desktop_infrastructure
Zoom Communications Workplace — versions see references

Weakness classification (CWE)

CWE-73 — External Control of File Name or Path
CWE-610 — Externally Controlled Reference to a Resource in Another Sphere

References

security@zoom.us (Vendor Advisory)

Frequently asked questions

What is CVE-2026-30903?: CVE-2026-30903 is a critical-severity vulnerability in Zoom Workplace_desktop, classified under External Control of File Name or Path. CVSS score: 9.6/10. Published 2026-03-11.
How severe is CVE-2026-30903?: Critical severity. CVSS v3 base score is 9.6 out of 10.