High

A series of newly disclosed vulnerabilities across Zoom software products could allow attackers to exploit affected systems, with the most serious risks impacting Windows environments. The flaws affect Zoom Rooms, the Zoom Workplace VDI Plugin, and Zoom Workplace. In response, Zoom has issued security patches to address these weaknesses and is urging users and organizations to update immediately. The vulnerabilities highlight the growing focus of threat actors on communication platforms widely used for enterprise collaboration and remote work.

The most critical issue, tracked as CVE-2026-30906, affects Zoom Rooms for Windows and stems from an untrusted search path weakness in the installer. This flaw could allow an authenticated local attacker to place malicious files in locations searched during installation, enabling privilege escalation and potentially granting administrative-level control over the affected system. Such exploitation could allow attackers to execute arbitrary code, modify system configurations, or establish persistence within the compromised environment.

A second high-severity Windows vulnerability, CVE-2026-30905, impacts the Zoom Workplace VDI Plugin Universal Installer. This issue involves improper handling of externally controlled file names or file paths during the installation process. By manipulating these paths, an attacker with local authenticated access could trigger unauthorized command execution, creating another pathway for privilege escalation. Both Windows vulnerabilities were discovered and responsibly disclosed by security researcher sim0nsecurity, reinforcing the importance of secure installer design and file validation mechanisms.

The third issue, CVE-2026-30904, affects Zoom Workplace for iOS and is considered low severity due to its limited exploitation conditions. Reported by security researcher, the flaw involves a protection mechanism failure that could expose sensitive information if exploited. However, successful exploitation requires physical access to the target device along with elevated privileges, resulting in a low CVSS score of low. To mitigate all three vulnerabilities, Zoom has released updated software versions across affected platforms. Organizations should prioritize patch deployment, enforce strong endpoint management practices, and ensure all users download the latest updates directly from Zoom’s official portal to reduce the risk of exploitation.