What is the CVSS score of CVE-2026-30901?

CVE-2026-30901 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by CVE-2026-30901?

Zoom Room versions up to 6.6.5 contain an input validation vulnerability that could allow attackers to compromise meeting room systems.

How to fix or mitigate CVE-2026-30901?

Within 24 hours: inventory all Zoom Room deployments and identify systems running versions ≤6.6.5; notify facility and AV teams of the risk. Within 7 days: contact Zoom support for patch timeline and workarounds; implement network segmentation to restrict Zoom Room administrative interfaces. Within 30 days: apply vendor patch immediately upon availability; conduct security validation testing post-patch.

Microsoft CVE-2026-30901

HIGH

Improper Input Validation (CWE-20)

2026-03-11 security@zoom.us

Privilege Escalation Microsoft

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 15:16 nvd

HIGH 7.0

DescriptionCVE.org

Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local access.

AnalysisAI

Improper Input Validation in Zoom Room versions up to 6.6.5 is affected by improper input validation (CVSS 7.0).

Technical ContextAI

This vulnerability (CWE-20: Improper Input Validation) affects Improper Input Validation in Zoom Room. Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local access.