Zoom Workplace VDI Plugin CVE-2026-30905

Exploitation requires an authenticated local session on a Windows host where the Zoom Workplace VDI Plugin Windows Universal Installer prior to 6.6.11 is present, and the ability to invoke the installer's privileged file-handling code path (install, repair, upgrade, or rollback) while controlling a filename or path input it consumes. No user interaction is required beyond the attacker's own actions (UI:N), and no elevated privileges are needed to start the attack (PR:L). Exploitation is limited to scenarios where the attacker already has local code execution on the endpoint - it is not remotely reachable (AV:L) - and to the Windows Universal Installer build of the plugin specifically; environments that have already upgraded to 6.6.11+ or that do not deploy the VDI plugin are not exposed.

The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H aligns coherently with the description: local access with low privileges and no user interaction yields full CIA impact on the host, which is the textbook local privilege escalation profile. EPSS at 0.01% (2nd percentile) and SSVC marking Exploitation as 'none' and Automatable as 'no' are consistent with one another and indicate this is not currently a mass-exploitation target, though Technical Impact is rated 'total'. The vulnerability is not on the CISA KEV list and no public exploit identified at time of analysis, so real-world urgency is moderate - this is a credible post-compromise escalation primitive on VDI endpoints (especially shared/multi-user Windows hosts where any logged-in user gaining SYSTEM is meaningful) but not an internet-exposed emergency. No conflicting signals are present in the data; the main unknown is whether a technical write-up or detection guidance will surface from VulDB beyond the Zoom bulletin reference.

An attacker who already has an interactive low-privileged session on a Windows VDI endpoint - for example a standard domain user on a shared Citrix worker, or malware running in user context after a phishing foothold - invokes the Zoom Workplace VDI Plugin installer's repair or upgrade flow and supplies an attacker-controlled path (via a symlink, junction, or planted file in a user-writable location) that the SYSTEM-level installer then acts upon. The result is arbitrary file write or DLL load under SYSTEM, escalating the user to full administrative control of the VDI host and any cached credentials present. No public exploit identified at time of analysis, but the CWE-73 pattern is well-documented and SSVC rates Technical Impact as total.