CVE-2026-30903 — AI Deep Analysis Summary

🚨 **Essence**: A critical security flaw in **Zoom Workplace**'s email feature. 📧 The system fails to sanitize **file names/paths** controlled by external inputs.…

🛡️ **Root Cause**: **CWE-73** (External Control of File Name or Path). 🐛 The application flaw lies in how it handles user-supplied file paths in the email functionality.…

🏢 **Affected Vendor**: **Zoom Communications**. 💻 **Product**: **Zoom Workplace** (Desktop Application). 📉 **Version**: All versions **prior to 6.6.0**. If you are running an older build, you are vulnerable.

💀 **Attacker Capabilities**: Hackers can achieve **Privilege Escalation**. 📂 They can access files/directories they shouldn't. 🔓 **Impact**: High Confidentiality, Integrity, and Availability loss.…

🔓 **Exploitation Threshold**: **Low** for Auth, **Medium** for UI. 🚫 **Auth**: **None Required** (PR:N). You don't need to be logged in. 👀 **UI**: **Required** (UI:R).…

🕵️ **Public Exploit**: **No**. 📭 The `pocs` field is empty. 🚫 No Proof-of-Concept (PoC) or wild exploitation code is currently available in the wild. It is currently a theoretical risk based on the description.

🔍 **Self-Check**: 1. Check your Zoom Workplace version. 📱 Is it **< 6.6.0**? 2. Review email handling features for suspicious file paths. 📂 Look for unusual file name injections in your email logs. 3.…

🛠️ **Official Fix**: **Yes**. 📅 Published: **2026-03-11**. ✅ The vendor has released a security bulletin (ZSB-26005). 🔄 **Mitigation**: Update Zoom Workplace to **version 6.6.0 or later** immediately.…

🚧 **No Patch Workaround**: If you cannot update: 1. Disable the **Email Feature** in Zoom Workplace if possible. 🚫 2. Avoid opening attachments or links from untrusted sources. 🛑 3.…

🔥 **Urgency**: **HIGH**. 📈 CVSS Vector indicates High Impact. 🚨 Even without public exploits, the **Unauthenticated** nature makes it dangerous. 🏃‍♂️ **Action**: Patch immediately to version 6.6.0+.…