Zoom and GitLab Release Security Updates Fixing RCE, DoS, and 2FA Bypass Flaws

Zoom and GitLab have issued security updates to fix flaws that could lead to denial-of-service and remote code execution. The most severe flaw is a critical vulnerability in Zoom Node Multimedia Routers (MMRs) that could let a meeting participant perform remote code execution over the network, tracked as CVE-2026-22844 with a CVSS score of 9.9. A Zoom security bulletin notes a command injection vulnerability in MMRs prior to version 5.2.1716.0.

GitLab also released patches for high-severity issues that could cause DoS or bypass 2FA, including CVE-2025-13927, CVE-2025-13928 and CVE-2026-0723, affecting various version ranges across CE and EE editions. In addition, two medium-severity DoS-affecting bugs (CVE-2025-13335 and CVE-2026-1102) were remediated alongside fixes for potential 2FA bypass. The article states there is no evidence of exploitation in the wild, and Zoom recommends updating to the latest MMR version to safeguard deployments.

According to Zoom, affected versions include Zoom Node Meetings Hybrid (ZMH) MMR modules before 5.2.1716.0 and Zoom Node Meeting Connector (MC) MMR modules before 5.2.1716.0.