What is the CVSS score of CVE-2026-30902?

CVE-2026-30902 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by CVE-2026-30902?

A privilege escalation vulnerability in Zoom's Windows client allows authenticated users to gain elevated system access on affected machines.

How to fix or mitigate CVE-2026-30902?

Within 24 hours: Inventory all Windows systems running affected Zoom versions and assess user privilege levels. Within 7 days: Implement network segmentation to isolate Zoom client traffic and enforce principle of least privilege for user accounts running Zoom. Within 30 days: Establish a continuous monitoring program for Zoom CVE patches and develop a rapid deployment plan once a fix becomes available.

Microsoft CVE-2026-30902

HIGH

Improper Privilege Management (CWE-269)

2026-03-11 security@zoom.us

Privilege Escalation Microsoft

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 15:16 nvd

HIGH 7.8

DescriptionCVE.org

Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.

AnalysisAI

Zoom Client for Windows contains a privilege escalation vulnerability that allows authenticated local users to gain elevated system privileges through improper access controls. An attacker with valid credentials can exploit this weakness to execute arbitrary code or access sensitive system resources without administrative approval. No patch is currently available for this issue.

Technical ContextAI

Classified as CWE-269 (Improper Privilege Management). Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.