What is CVE-2026-30906?

CVE-2026-30906 is a high-severity vulnerability in Zoom Rooms, classified under Untrusted Search Path. CVSS score: 7.8/10. Published 2026-05-13.

How severe is CVE-2026-30906?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Zoom Rooms

CVE-2026-30906

Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.

Published 2026-05-13 · last modified 2026-10-26.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.001 (1.7th percentile), scored 2026-10-28.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 2nd percentile — 1.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.001 · change: -0.000

Affected products

Zoom Rooms
Zoom Communications Rooms — versions 0

Weakness classification (CWE)

CWE-426 — Untrusted Search Path

References

www.zoom.com/en/trust/security-bulletin/zsb-26008 (Vendor Advisory)

Frequently asked questions

What is CVE-2026-30906?: CVE-2026-30906 is a high-severity vulnerability in Zoom Rooms, classified under Untrusted Search Path. CVSS score: 7.8/10. Published 2026-05-13.
How severe is CVE-2026-30906?: High severity. CVSS v3 base score is 7.8 out of 10.