CVE-2026-30902: 
Zoom Rooms vulnerability analysis and mitigation

CVE-2026-30902 is an Improper Privilege Management vulnerability (CWE-269) in certain Zoom Clients for Windows that may allow an authenticated user to escalate privileges via local access. It was disclosed by Zoom on March 10, 2026, under security bulletin ZSB-26004. Affected products include Zoom Workplace Desktop for Windows (before 6.6.0), Zoom Rooms for Windows (before 6.6.0), and Zoom Workplace Virtual Desktop Infrastructure (VDI) for Windows (versions 6.4.0–6.4.15, 6.5.0–6.5.13, and 6.6.0–6.6.10). The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Zoom Advisory, Zoom Security Bulletin).

The root cause is classified as CWE-269 (Improper Privilege Management), meaning the affected Zoom client components on Windows do not correctly enforce privilege boundaries, allowing a lower-privileged authenticated user to gain elevated system access. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable by any authenticated user on the affected system without additional conditions. No specific technical write-up or public proof-of-concept code has been identified at this time (Zoom Advisory).

Successful exploitation could result in complete compromise of the affected Windows system's confidentiality, integrity, and availability — all rated High in the CVSS scoring. An attacker with local access could read sensitive data, modify or delete files, execute arbitrary code at elevated privilege levels, or disrupt system availability. In shared or multi-user environments (such as VDI deployments), this could facilitate lateral movement or broader organizational compromise (Zoom Advisory, Zoom Security Bulletin).

Zoom has released patched versions addressing this vulnerability. Users should update to Zoom Workplace Desktop for Windows 6.6.0 or later, Zoom Rooms for Windows 6.6.0 or later, and Zoom Workplace VDI for Windows 6.4.15, 6.5.13, or 6.6.10 (or later within their respective branches). Updates are available at https://zoom.us/download. As an interim measure, organizations should restrict local access to systems running affected Zoom clients to trusted users only and monitor for suspicious privilege escalation activity (Zoom Advisory, Zoom Security Bulletin).

Security news outlets including CyberSecurityNews and SecurityOnline covered the disclosure, noting the privilege escalation risk for Windows users (CyberSecurityNews). Heise Online reported on the vulnerability, highlighting that Zoom's video conferencing software could allow attackers to escalate privileges (Heise Online). The Daily Tech Feed urged immediate updates, and Tenable published detection plugins for the vulnerability. Overall community sentiment reflects routine concern appropriate for a local privilege escalation in widely deployed enterprise software, with no extraordinary alarm given the absence of active exploitation.