Paper/Archive/CVE-2026-30903

CVE-2026-30903

Zoom Communications Zoom Workplace — External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to…

EPSS 0.3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 27.6.276 × 205.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.

Affected

ProductAffectedFixed inSource

Zoom Workplacesee references–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Zoom (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refzoom.com/en/trust/security-bulletin/zsb-26005