What is CVE-2026-30905?

CVE-2026-30905 is a high-severity vulnerability in Zoom Workplace Virtual Desktop Infrastructure, classified under External Control of File Name or Path. CVSS score: 7.8/10. Published 2026-05-13.

How severe is CVE-2026-30905?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Zoom Workplace Virtual Desktop Infrastructure

CVE-2026-30905

External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access.

EPSS: 0.001 (1.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Zoom Workplace_virtual_desktop_infrastructure
Zoom Communications Workplace Vdi Plugin — versions 0

Weakness classification (CWE)

CWE-73 — External Control of File Name or Path
CWE-610 — Externally Controlled Reference to a Resource in Another Sphere

References

security@zoom.us (Vendor Advisory)

Frequently asked questions

What is CVE-2026-30905?: CVE-2026-30905 is a high-severity vulnerability in Zoom Workplace Virtual Desktop Infrastructure, classified under External Control of File Name or Path. CVSS score: 7.8/10. Published 2026-05-13.
How severe is CVE-2026-30905?: High severity. CVSS v3 base score is 7.8 out of 10.