InfoSecBulletin Cybersecurity for mankind
Zoom has issued four security bulletins detailing several vulnerabilities in its windows client suite. The critical vulnerability CVE-2026-30903 (ZSB-26005) affects the Mail feature in Zoom Workplace for Windows.
The issue arises from External Control of File Name or Path, which allows attackers to manipulate file references and carry out unauthorized actions. An unauthenticated user could exploit this vulnerability remotely to gain higher privileges on affected systems.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
The CVSS vector shows that the attack can be done remotely and without authentication, making it the most severe of the four issues. All Zoom Workplace for Windows versions earlier than 6.6.0 are affected.
Privilege Management and Input Validation Vulnerabilities
CVE-2026-30902, CVE-2026-30901, CVE-2026-30900
Zoom has regularly addressed similar Windows privilege escalation issues recently, including a Critical CVE-2025-49457 (CVSS 9.6) reported in August 2025, which also enabled unauthenticated privilege escalation over the network for multiple Windows clients.
| CVE ID | Bulletin | Product | Vulnerability Type | Severity | Published |
|---|---|---|---|---|---|
| CVE-2026-30903 | ZSB-26005 | Zoom Workplace for Windows | External Control of File Name or Path | Critical | 03/10/2026 |
| CVE-2026-30902 | ZSB-26004 | Zoom Clients for Windows | Improper Privilege Management | High | 03/10/2026 |
| CVE-2026-30901 | ZSB-26003 | Zoom Rooms for Windows | Improper Input Validation | High | 03/10/2026 |
| CVE-2026-30900 | ZSB-26002 | Zoom Workplace Clients for Windows | Improper Check | High | 03/10/2026 |
Steps to Mitigate:
Zoom has released patches for all four vulnerabilities. Organizations and users should act promptly:
Update all Zoom Workplace for Windows installations to version 6.6.0 or later.
Update Zoom Rooms for Windows and Zoom Clients for Windows to the latest available build.
Download updates directly from the official Zoom download portal at zoom.us/download.
Prioritize patching endpoints where Zoom Workplace is actively used, particularly in email-intensive or enterprise virtual desktop environments.
Monitor network traffic for anomalous Zoom-related file access patterns that may indicate exploitation attempts against CVE-2026-30903.
