Zoom fixed critical Node Multimedia Routers flaw

Zoom fixed a critical security vulnerability tracked as CVE-2026-22844 (CVSS 9.9) in Zoom Node Multimedia Routers (MMRs) that could result in remote code execution, according to Zoom. The flaw affects Node Meeting Connector MMR module versions prior to 5.2.1716.0 and Node Meetings Hybrid MMR module versions prior to 5.2.1716.0, and was discovered by Zoom’s Offensive Security team. In August 2025, Zoom addressed a separate critical flaw, CVE-2025-49457 (CVSS 9.6), in Zoom Clients for Windows.

An unauthenticated user can exploit that vulnerability to escalate privileges via network access. The company has released security updates to address multiple vulnerabilities, including command injection in the MMRs, and there are no known attacks in the wild exploiting the CVE-2026-22844 flaw.