{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22844", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "state": "PUBLISHED", "assignerShortName": "Zoom", "dateReserved": "2026-01-12T12:20:38.435Z", "datePublished": "2026-01-20T13:57:44.803Z", "dateUpdated": "2026-01-20T16:45:18.457Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Zoom Node", "vendor": "Zoom Communications Inc.", "versions": [{"lessThan": "5.2.1716.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "datePublic": "2026-01-20T13:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(247, 247, 248);\">A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access.</span><br>"}], "value": "A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2026-01-20T13:57:44.803Z"}, "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-26001"}], "source": {"discovery": "UNKNOWN"}, "title": "Zoom Node Deployments - Command Injection", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T16:45:07.547573Z", "id": "CVE-2026-22844", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T16:45:18.457Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22844", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-20T16:45:07.547573Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T16:45:13.453Z"}}], "cna": {"title": "Zoom Node Deployments - Command Injection", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zoom Communications Inc.", "product": "Zoom Node", "versions": [{"status": "affected", "version": "0", "lessThan": "5.2.1716.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-01-20T13:00:00.000Z", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-26001"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(247, 247, 248);\">A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2026-01-20T13:57:44.803Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22844", "state": "PUBLISHED", "dateUpdated": "2026-01-20T16:45:18.457Z", "dateReserved": "2026-01-12T12:20:38.435Z", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "datePublished": "2026-01-20T13:57:44.803Z", "assignerShortName": "Zoom"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos en los Routers Multimedia (MMR) de Zoom Node anteriores a la versi\u00f3n 5.2.1716.0 podr\u00eda permitir a un participante de la reuni\u00f3n realizar la ejecuci\u00f3n remota de c\u00f3digo del MMR a trav\u00e9s del acceso a la red."}], "id": "CVE-2026-22844", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security@zoom.us", "type": "Secondary"}]}, "published": "2026-01-20T14:16:21.980", "references": [{"source": "security@zoom.us", "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-26001"}], "sourceIdentifier": "security@zoom.us", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security@zoom.us", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:45:45.223013+00:00", "value": {"mitigation_remediation": ["Update the MMR firmware to 5.2.1716.0 or later, which contains the fix for the command injection flaw.", "If an update is not immediately possible, isolate the MMR from untrusted networks and enforce strict participant role restrictions to minimize exposure.", "Apply network segmentation and firewall rules to limit traffic to only necessary management interfaces of the MMR.", "Continuously monitor the MMR logs for anomalous command execution or unexpected system calls to detect potential exploitation attempts."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Zoom Communications Inc. Zoom Node-MMR devices with firmware versions earlier than 5.2.1716.0 are affected. Any deployment that has not been updated to at least this version is vulnerable.", "description_and_impact": "A command injection flaw in Zoom Node Multimedia Routers (MMRs) allows a meeting participant with network access to execute arbitrary commands on the device. The vulnerability resides in input handling that is not properly sanitized, giving the attacker control over system command execution, which can lead to full compromise of the MMR, including data exfiltration, service disruption, or further attacks against connected infrastructure.", "risk_and_exploitability": "The flaw is assigned a CVSS score of 9.9, indicating a critical severity. The EPSS score is below 1%, suggesting low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network-based attack that a meeting participant can perform after joining the session, exploiting the insufficient input validation to inject malicious commands."}}}}, "created": "2026-01-21T11:19:00.242791+00:00", "updated": "2026-04-18T16:00:04.273531+00:00", "vendors": ["zoom", "zoom$PRODUCT$zoom"]}