Zoom
CVE-2026-30900
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Zoom client
-
DeliveryAccess update functionality
-
ExploitBypass minimum version check
-
ExecutionInstall malicious update package
-
ImpactExecute arbitrary code with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Unusual condition handling
|
| Exploitation Conditions | Authenticated local user account on Windows system running vulnerable Zoom Client with update functionality enabled. Attacker requires valid Zoom credentials and local system access to exploit the improper version validation in the update mechanism. |
| Impact | CVSS 7.8 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication. Exploitable via local access. |
| Exploit ScenarioDerived | An attacker (requires authentication) could exploit this vulnerability to an authenticated user to conduct an escalation of privilege via local access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Zoom's Windows client fails to properly validate minimum version requirements during updates, enabling authenticated local users to escalate their privileges on affected systems. An attacker with local access and valid credentials could exploit this validation bypass to gain elevated permissions. No patch is currently available for this vulnerability.
Earlier versions of this analysis (1)
Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access. [CVSS 7.8 HIGH]
RemediationAI
Monitor vendor advisories for a patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-754: Improper Check for Unusual or Exceptional Conditions) exists in the update component. Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
Know when Zoom gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
Executive ViewAI
CVE-2026-30900 affects Zoom Clients for Windows and allows authenticated users to escalate privileges through a flaw in update version checking. This poses a risk to any organization using Zoom on Windows endpoints, particularly those with users who have local administrative access or operate in high-security environments where privilege escalation could enable lateral movement or data exfiltration.
Restrict Zoom client installation and execution to non-administrative user accounts; implement application control policies (AppLocker/Windows Defender Application Control) to prevent unauthorized process execution; enforce principle of least privilege by removing unnecessary local admin rights; monitor and log Zoom process behavior and file system modifications; segment network access to limit lateral movement from compromised endpoints; consider disabling Zoom's auto-update feature until patch is available and implement manual, controlled update procedures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
Related Vulnerabilities in Zoom Windows Clients Privilege Escalation
View all 4The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when c
Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote
An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including anima
Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary cod
An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages incl
The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-134
Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during install
Video Conferencing with Zoom WordPre versions up to 4.6.6 is affected by improper authentication (CVSS 7.5).
airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector (IV) for AES-256 CBC e
airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of a
Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Rated high severity (CVS
GitHub PoC
Exploit-DB