External risk intelligence

Zoom Workplace VDI Plugin: Privilege Escalation Risk

CVE advisorySeverity: HIGH (CVSS 7.8)

CVE-2026-30905

The vulnerability exists in a local installer for a VDI plugin. It requires local access to the system to exploit, meaning it is not reachable via the public internet.

Zoom Workplace Virtual Desktop Infrastructure

before 6.6.11

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The Zoom Workplace VDI Plugin for Windows Universal Installer contains a flaw related to how it handles file names and paths. This weakness could potentially allow an authenticated user with local access to gain elevated privileges on the affected system. The core issue stems from the external control of file names or paths within the installer.

Vulnerable Zoom VDI Plugin installer
Flaw allows privilege escalation
Impact on authenticated local users

Attack Path

How an attacker could exploit the issue

An authenticated user with local access may be able to escalate privileges using the Zoom Workplace VDI Plugin for Windows. The vulnerability exists within the installer, and exploiting it could lead to an attacker gaining elevated permissions on the affected system. This could impact the confidentiality, integrity, and availability of the system and its data.

Requires authenticated local access.
Attacker triggers installer vulnerability.
Results in privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

The Zoom Workplace VDI Plugin for Windows contains a vulnerability that could allow an authenticated user with local access to escalate privileges. This could impact organizations by allowing unauthorized access and modification of systems. The potential for privilege escalation warrants careful consideration of affected systems.

Attacker skill level: Basic
Required access or conditions: Local access
Business risk or urgency: High

Operational Fix

Recommended remediation, mitigation, and detection steps

The Zoom Workplace VDI Plugin for Windows has a vulnerability that could allow an authenticated user with local access to escalate privileges. This risk affects organizations using this specific plugin. The exploitation requires local access to the affected system, which reduces the potential attack surface.

Identify all systems with the VDI plugin installed.
Restrict local access to VDI plugin systems.
Apply vendor updates and verify.
Monitor for related activity.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Zoom Workplace VDI Plugin and its function in virtual environments?

The Zoom Workplace VDI Plugin is a component of the Windows Universal Installer designed for virtual desktop infrastructure (VDI) environments. It enables users to utilize Zoom services seamlessly within these virtualized setups.

What weakness class is associated with CVE-2026-30905, and how does it manifest?

CVE-2026-30905 is classified under the 'External Control of File Name or Path' weakness (CWE-73). This indicates that the software does not adequately validate file names or paths provided by external inputs, potentially leading to unintended file operations or system compromises.

What are the necessary conditions for an attacker to exploit the Zoom VDI Plugin vulnerability?

Exploiting this vulnerability requires an attacker to first possess authenticated local access to the affected system. This condition limits the attack vector to users already on the system, preventing remote exploitation.

How does Halo classify the exposure of CVE-2026-30905, considering its attack vector?

Halo classifies CVE-2026-30905 as an internal exposure because the CVSS v3.1 attack vector is identified as Local (AV:L). This means the vulnerability is only reachable from the local system, not over the internet.

What practical steps can organizations take to mitigate the risk associated with the Zoom VDI Plugin vulnerability?

Organizations should identify all systems with the VDI plugin installed, restrict local access to these systems, and promptly apply vendor updates. Continuous monitoring for suspicious activity related to the plugin is also recommended.

References

www.zoom.com/en/trust/security-bulletin/zsb-26007

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.