Zoom
CVE-2026-22844
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as meeting participant
-
ExploitSend crafted input to MMR interface
-
ExecutionInject OS commands in parameter
-
ImpactExecute arbitrary code on MMR
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Zoom Node Multimedia Router (MMR) version before 5.2.1716.0 with meeting participant access enabled. Attacker requires valid meeting participant credentials to access the vulnerable MMR interface. |
| Impact | CVSS 9.9 — Zoom MMRs handle multimedia routing for Zoom meetings. Compromise could enable mass surveillance of Zoom meetings, data exfiltration, or lateral movement into corporate networks. |
| Exploit ScenarioDerived | A meeting participant sends a crafted request through the Zoom client that injects OS commands on the MMR, gaining a shell on the routing server and potentially intercepting audio/video streams from multiple meetings. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 have a CVSS 9.9 command injection vulnerability allowing meeting participants to execute OS commands on the router.
Earlier versions of this analysis (1)
Command injection in Zoom MMR enables meeting participants to achieve RCE on routing infrastructure.
RemediationAI
Update Zoom MMRs to version 5.2.1716.0 or later immediately. Monitor MMR logs for suspicious command execution.
Affected ProductsAI
Zoom Node Multimedia Routers (MMRs) < 5.2.1716.0
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Zoom Node MMRs < 5.2.1716.0 have a CWE-78 OS command injection vulnerability that allows authenticated meeting participants to inject and execute arbitrary commands on the multimedia routing infrastructure.
Know when Zoom gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access.
Executive ViewAI
CVE-2026-22844 presents critical security risk, a OS command injection vulnerability rated CVSS 9.9. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when c
Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote
An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including anima
Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary cod
An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages incl
The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-134
Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during install
Video Conferencing with Zoom WordPre versions up to 4.6.6 is affected by improper authentication (CVSS 7.5).
airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector (IV) for AES-256 CBC e
airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of a
Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Rated high severity (CVS
GitHub PoC
Exploit-DB