Zoom Workplace for Windows flaws can let attackers gain elevated access

Zoom has disclosed four Windows security vulnerabilities, including one Critical flaw that could let an unauthenticated attacker escalate privileges over the network. The issues affect Zoom Workplace for Windows, Zoom Clients for Windows, and Zoom Rooms for Windows, and Zoom published all four bulletins on March 10, 2026.

The most serious issue is CVE-2026-30903, tracked by Zoom as ZSB-26005. Zoom classifies it as a Critical “External Control of File Name or Path” vulnerability in Zoom Workplace for Windows. The bulletin page lists the flaw as affecting Zoom Workplace for Windows, and Zoom’s release notes point users to the latest app build through its Download Center.

For businesses, this is a patch-now update. A privilege escalation flaw inside a widely used collaboration app can become a useful stepping stone after phishing, malware delivery, or lateral movement. In this case, Zoom’s own bulletin list shows that the Critical flaw sits alongside three High-severity Windows issues published the same day.

What Zoom disclosed on March 10

Zoom’s official security bulletin page lists these four new Windows flaws:

The headline vulnerability is CVE-2026-30903 because Zoom ranks it as Critical, while the other three receive High severity ratings. Zoom does not publish detailed exploit steps on the bulletin page, but it clearly advises customers to update to the latest version to get the fixes and security improvements.

The Critical Zoom Workplace bug stands out

CVE-2026-30903 affects Zoom Workplace for Windows. Zoom labels it as an “External Control of File Name or Path” issue, a weakness class that can open the door to unauthorized operations when software mishandles file references or paths.

The sample you shared says versions earlier than 6.6.0 are affected. Zoom’s public bulletin page confirms the CVE and severity, while Zoom’s Windows Workplace release notes direct users to current releases through the official Download Center. Based on those official pages, the safe practical takeaway is straightforward: update Zoom Workplace for Windows to the newest available patched build from Zoom.

Three more High-severity Windows vulnerabilities

The other three March 10 bulletinshttps://www.zoom.com/en/trust/security-bulletin/?utm_source=chatgpt.com are also important because they hit Windows deployments across different Zoom products. Zoom lists them as:

• CVE-2026-30902 in Zoom Clients for Windows, described as Improper Privilege Management
• CVE-2026-30901 in Zoom Rooms for Windows, described as Improper Input Validation
• CVE-2026-30900 in Zoom Workplace Clients for Windows, described as Improper Check

Each one could help an attacker move from limited access to higher privileges or trigger unintended behavior on a Windows system. Even without public proof of in-the-wild exploitation, these are the kinds of flaws IT teams usually treat seriously because Zoom often runs on employee laptops, meeting room systems, and managed enterprise desktops.

Why enterprises should move fast

Zoom says it does not provide customer-specific impact guidance in its bulletin listings, but it does recommend updating to the latest version of Zoom software to get the newest fixes and security improvements. That statement matters because all four bulletins landed together, with one Critical and three High-severity issues affecting Windows software.

For enterprise teams, the risk goes beyond a single endpoint. A vulnerable collaboration app can sit on user devices, virtual desktop environments, and conference room systems. If attackers find a way in, privilege escalation bugs can help them dig deeper into the environment. That makes rapid patching, version inventory, and Windows endpoint monitoring especially important after this batch of disclosures. This risk assessment is an inference based on the affected product types and the privilege-escalation nature of the flaws.

What admins and users should do now

Zoom’s official guidance is simple: update to the latest version. Zoom’s Zoom Workplace app release notes say users can download the latest version from the Download Center, and the security bulletin page says customers should update to the newest software for fixes and security improvements.

• Update Zoom Workplace for Windows to the latest patched release from Zoom
• Update Zoom Clients for Windows and Zoom Rooms for Windows as well
• Check managed endpoints for older Zoom builds still in circulation
• Prioritize Windows systems used for email, meetings, shared workspaces, and VDI
• Watch for unusual behavior tied to Zoom-related processes after patching

Quick summary

FAQ