Zoom Workplace iOS CVE-2026-30904

Exploitation requires the attacker to have physical access to the iOS device (AV:P as confirmed by CVSS vector) and to be an authenticated user with high privileges on the Zoom application (PR:H). The vulnerable device must be running Zoom Workplace for iOS on any version below 7.0.0. Remote exploitation is not possible - the physical access vector is a hard constraint. The high privilege requirement further limits the attack to users who already have significant authorization within the Zoom application context. The limited confidentiality impact (C:L) means only a subset of information is at risk, not full data exposure. Non-iOS platforms are not implicated in the available data.

Real-world risk is very low across all available signals. The CVSS score of 1.8 reflects three compounding constraints: physical access required (AV:P), high privileges required (PR:H), and only low confidentiality impact (C:L) with no integrity or availability impact. EPSS is 0.02% at the 5th percentile, meaning fewer than 5% of CVEs are less likely to be exploited - this is one of the least likely exploitation scenarios statistically. SSVC signals are similarly benign: exploitation status is none, the attack is not automatable, and technical impact is only partial. No KEV listing and no public exploit code have been identified. The combination of needing to be physically present, already authenticated (PR:H), and on an unpatched iOS device makes opportunistic or remote exploitation impossible. This is a low-priority vulnerability for most organizations, with patch application being sufficient and urgent remediation unlikely to be necessary.

An individual with physical access to an unlocked iOS device - for example, an IT administrator or someone who finds an unattended device - opens or interacts with the Zoom Workplace app on a version prior to 7.0.0 and is able to view information that should be protected by an iOS security mechanism, such as cached screen content, notification details, or data surfaced through an accessibility interface. No exploit code or POC has been identified at time of analysis. The physical access and high privilege prerequisites make this scenario realistically confined to insider threat or device theft contexts.