Zoom fixed critical Node Multimedia Routers flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-49457 | Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access NVD description · AI analysis pending | 8.8 | <1% |
| — | ||
| CVE-2026-22844 | A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execut A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access. NVD description · AI analysis pending | 9.9 | 13% | — | — |
Full article212 words · extracted from securityaffairs.com · click to collapse
Zoom addressed a critical security vulnerability, tracked as CVE-2026-22844, that could result in remote code execution.
Cloud-based video conferencing and online collaboration platform Zoom released security updates to address multiple vulnerabilities, including command injection, tracked as CVE-2026-22844 (CVSS score of 9.9), in Zoom Node Multimedia Routers (MMRs) that could result in remote code execution.
“A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access.” reads the advisory. “Customers that are using Zoom Node Meetings Hybrid or Meeting Connector deployments are advised to have their administrators update to the latest available MMR version.”
The company’s Offensive Security team discovered the vulnerability.
The flaw impacts the following products:
- Node Meeting Connector (MC) MMR module versions prior to 5.2.1716.0
- Node Meetings Hybrid (ZMH) MMR module versions prior to 5.2.1716.0
The company is not aware of attacks in the wild exploiting this vulnerability.
In August 2025, Zoom addressed a critical security flaw, tracked as CVE-2025-49457 (CVSS score of 9.6) in Zoom Clients for Windows.
An unauthenticated user can exploit the vulnerability to conduct an escalation of privilege via network access.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2026-22844)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/187165/security/zoom-fixed-critical-node-multimedia-routers-flaw.html