CVE-2026-30903: Zoom Workplace Privilege Escalation Flaw

CVE-2026-30903 Overview

CVE-2026-30903 is a critical External Control of File Name or Path vulnerability (CWE-73) affecting the Mail feature of Zoom Workplace for Windows. This vulnerability allows an unauthenticated attacker to conduct an escalation of privilege via network access by manipulating file paths within the application's mail functionality.

Critical Impact

Unauthenticated attackers can escalate privileges through network-based exploitation of the Mail feature in Zoom Workplace for Windows, potentially leading to complete system compromise with high impact on confidentiality, integrity, and availability.

Affected Products

• Zoom Workplace for Windows versions before 6.6.0
• Zoom Workplace Mail feature component

Discovery Timeline

• March 11, 2026 - CVE-2026-30903 published to NVD
• March 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-30903

Vulnerability Analysis

This vulnerability is classified under CWE-73 (External Control of File Name or Path), which occurs when software allows external input to influence file paths or names without proper validation. In the context of Zoom Workplace for Windows, the Mail feature fails to properly sanitize user-controlled input that specifies file paths, enabling attackers to manipulate these paths for malicious purposes.

The vulnerability is particularly severe because it can be exploited by unauthenticated users over the network with minimal interaction required. The changed scope indicator means successful exploitation can impact resources beyond the vulnerable component's security scope, potentially affecting the underlying Windows operating system or other applications on the system.

Root Cause

The root cause stems from insufficient input validation in the Mail feature's file handling routines. When processing mail-related operations, the application accepts externally controlled input to construct file paths without adequately verifying that the resulting path falls within expected boundaries. This allows attackers to craft malicious input that references arbitrary file system locations.

Attack Vector

The attack is conducted over the network against Zoom Workplace for Windows installations. An attacker can exploit this vulnerability by sending specially crafted data to the Mail feature that manipulates file path parameters. While some user interaction is required, successful exploitation grants the attacker elevated privileges on the target system. The network-accessible nature of this vulnerability combined with no authentication requirements makes it particularly dangerous in enterprise environments where Zoom Workplace is widely deployed.

Due to the sensitive nature of this vulnerability, specific exploitation techniques are not provided. Technical details regarding the exploitation methodology can be found in the Zoom Security Bulletin ZSB-26005.

Detection Methods for CVE-2026-30903

Indicators of Compromise

• Unusual file access patterns or file operations initiated by Zoom Workplace processes targeting unexpected system directories
• Zoom application processes attempting to access or modify files outside of their normal operational scope
• Suspicious network connections to Zoom Workplace Mail feature followed by privilege escalation events
• Unexpected process spawning or command execution originating from Zoom Workplace components

Detection Strategies

• Monitor for abnormal file path operations originating from Zoom.exe or related Zoom Workplace processes
• Implement application whitelisting and monitor for violations by Zoom components
• Deploy endpoint detection rules to identify path traversal patterns in Zoom Workplace file operations
• Enable enhanced process auditing to track privilege escalation attempts following Zoom Mail feature interactions

Monitoring Recommendations

• Enable Windows Security Event logging for file system access (Event IDs 4663, 4656)
• Configure SentinelOne behavioral AI to detect anomalous file access patterns from Zoom processes
• Implement network monitoring for suspicious traffic patterns to Zoom Workplace Mail endpoints
• Review Zoom application logs for malformed mail requests or unusual file path references

How to Mitigate CVE-2026-30903

Immediate Actions Required

• Upgrade Zoom Workplace for Windows to version 6.6.0 or later immediately
• If immediate patching is not possible, consider temporarily disabling or restricting access to the Mail feature
• Review systems for signs of compromise if vulnerable versions were exposed to untrusted networks
• Implement network segmentation to limit exposure of Zoom Workplace installations

Patch Information

Zoom has addressed this vulnerability in Zoom Workplace for Windows version 6.6.0. Organizations should prioritize upgrading to this version or later. For detailed patch information and verification, refer to the Zoom Security Bulletin ZSB-26005.

Workarounds

• Disable the Mail feature in Zoom Workplace for Windows until patching can be completed
• Implement strict network access controls to limit who can communicate with Zoom Workplace installations
• Deploy web application firewall rules to filter potentially malicious input targeting Zoom services
• Consider using Zoom Web Client as an alternative while patching desktop installations

# Verify current Zoom Workplace version via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | Where-Object { $_.DisplayName -like "*Zoom Workplace*" } | Select-Object DisplayName, DisplayVersion

# Check if installed version is vulnerable (versions below 6.6.0)
# Upgrade to 6.6.0 or later via Zoom's official download center