Cyber Resilience

CVE-2026-30905

HighUpdated

Published: 13 May 2026

Published
13 May 2026
Modified
03 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0001 2.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-30905 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Zoom Workplace Virtual Desktop Infrastructure. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access.

CWE(s)
CWE-73CWE-610

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

CWE-73 path control in local installer directly enables local privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-30903Same product: Zoom Workplace Virtual Desktop Infrastructure
CVE-2026-30900Same product: Zoom Workplace Virtual Desktop Infrastructure
CVE-2026-30902Same product: Zoom Workplace Virtual Desktop Infrastructure
CVE-2025-0151Same product: Zoom Workplace Virtual Desktop Infrastructure
CVE-2025-27440Same product: Zoom Workplace Virtual Desktop Infrastructure
CVE-2025-27439Same product: Zoom Workplace Virtual Desktop Infrastructure
CVE-2024-45421Same product: Zoom Workplace Virtual Desktop Infrastructure
CVE-2024-45418Same vendor: Zoom
CVE-2025-0147Same vendor: Zoom
CVE-2025-49457Same product: Zoom Workplace Virtual Desktop Infrastructure

Affected Assets

zoom
workplace virtual desktop infrastructure
≤ 6.6.11

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-73

Rejects externally supplied file or resource identifiers that fail validity checks.

SI-22 Information Diversity
addresses: CWE-610

Limits impact of an externally controlled reference to a primary information resource by switching to an identified alternative.

References