Zoom Rooms CVE-2026-30906

Local access to a Windows host running Zoom Rooms below 7.0.0 with valid low-privileged credentials (PR:L) is required, and the vulnerable installer must actually execute in an elevated context - meaning exploitation is gated on either an installer/upgrade event occurring while the attacker has write access to a directory in the installer's search path, or the attacker being able to trigger that installer run. No user interaction by another party is required (UI:N), and attack complexity is low (AC:L). Exploitation is limited by: the need for prior local foothold (no remote vector), the need for the installer process to be invoked during the attacker's window of opportunity, and Windows-only applicability - Zoom Rooms on macOS/iPad/Android is not in scope per the available CPE and EUVD data.

Signals are largely consistent and point to a moderate, not urgent, priority. CVSS 7.8 with vector AV:L/AC:L/PR:L/UI:N reflects local access with low privileges required and no user interaction - classic LPE profile. EPSS at 0.01% (2nd percentile) and SSVC 'Exploitation: none' / 'Automatable: no' align: there is no public exploit identified at time of analysis and the issue is not in CISA KEV. However, SSVC technical impact is rated 'total,' matching the C:H/I:H/A:H trio - once exploited, the attacker fully owns the host. The realistic risk concentrates on environments where untrusted local users can trigger installer execution (multi-user kiosks, conference room PCs where Zoom Rooms is commonly deployed, and managed endpoints where staff run the installer from a user-writable download location). No conflicting data was identified across NVD, EUVD, Zoom's bulletin, and CISA's SSVC, so confidence in the moderate-priority categorization is high.

A standard (non-admin) user on a shared Windows endpoint - for example, a meeting-room PC or a corporate workstation where Zoom Rooms is installed or being upgraded - plants a malicious DLL or executable in a directory that the vulnerable installer searches before its intended trusted path. When the installer runs with elevated privileges (either auto-launched, scheduled, or triggered by an admin's upgrade workflow), it loads the attacker-controlled binary in the elevated context, yielding SYSTEM-level code execution. No public exploit is identified at time of analysis, but the technique is well-understood and the attack complexity is low.