CVE-2026-30903 CRITICAL

CVE-2026-30903

Vendor Zoom Communications

Product Zoom Workplace

Weakness CWE-73

Published March 11, 2026

Last update March 12, 2026

View on NVD All CVEs

CVSS base score

9.6/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.

Key dates

02Disclosure timeline

March 11, 2026 CVE published

March 12, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-30903 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/73.html

Related vulnerabilities

04Related CVE

CVE-2025-10058 WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2022-4983 TEC-IT TBarCode SDK 11.15 Remote File Create CVE-2020-2003 PAN-OS: Authenticated administrator can delete arbitrary system file CVE-2025-54945 SUNNET Corporate Training Management System - External Control of File Name or Path CVE-2024-26185 Windows Compressed Folder Tampering Vulnerability