InfoSecBulletin Cybersecurity for mankind
Zoom has issued four security bulletins detailing several vulnerabilities in its windows client suite. The critical vulnerability CVE-2026-30903 (ZSB-26005) affects the Mail feature in Zoom Workplace for Windows.
The issue arises from External Control of File Name or Path, which allows attackers to manipulate file references and carry out unauthorized actions. An unauthenticated user could exploit this vulnerability remotely to gain higher privileges on affected systems.
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
The CVSS vector shows that the attack can be done remotely and without authentication, making it the most severe of the four issues. All Zoom Workplace for Windows versions earlier than 6.6.0 are affected.
Privilege Management and Input Validation Vulnerabilities
CVE-2026-30902, CVE-2026-30901, CVE-2026-30900
Zoom has regularly addressed similar Windows privilege escalation issues recently, including a Critical CVE-2025-49457 (CVSS 9.6) reported in August 2025, which also enabled unauthenticated privilege escalation over the network for multiple Windows clients.
| CVE ID | Bulletin | Product | Vulnerability Type | Severity | Published |
|---|---|---|---|---|---|
| CVE-2026-30903 | ZSB-26005 | Zoom Workplace for Windows | External Control of File Name or Path | Critical | 03/10/2026 |
| CVE-2026-30902 | ZSB-26004 | Zoom Clients for Windows | Improper Privilege Management | High | 03/10/2026 |
| CVE-2026-30901 | ZSB-26003 | Zoom Rooms for Windows | Improper Input Validation | High | 03/10/2026 |
| CVE-2026-30900 | ZSB-26002 | Zoom Workplace Clients for Windows | Improper Check | High | 03/10/2026 |
Steps to Mitigate:
Zoom has released patches for all four vulnerabilities. Organizations and users should act promptly:
Update all Zoom Workplace for Windows installations to version 6.6.0 or later.
Update Zoom Rooms for Windows and Zoom Clients for Windows to the latest available build.
Download updates directly from the official Zoom download portal at zoom.us/download.
Prioritize patching endpoints where Zoom Workplace is actively used, particularly in email-intensive or enterprise virtual desktop environments.
Monitor network traffic for anomalous Zoom-related file access patterns that may indicate exploitation attempts against CVE-2026-30903.
