Critical Zoom Flaw (CVE-2026-22844): CVSS 9.9 Command Injection Exposes Hybrid Meetings

A near-maximum severity vulnerability has been discovered in Zoom’s enterprise infrastructure, tracked as CVE-2026-22844 with a CVSS of 9.9, potentially turning hybrid meeting setups into open doors for attackers. According to the advisory, the issue is a “Command Injection vulnerability” affecting Zoom Node Multimedia Routers (MMRs) prior to version 5.2.1716.0, with a malicious actor able to exploit it via network access without physical server access.

The flaw could allow a meeting participant to conduct remote code execution of the MMR, enabling hijack of the underlying system processing the meeting’s media. It specifically targets Zoom Node Meetings Hybrid (ZMH) MMR modules and Zoom Node Meeting Connector (MC) MMR modules, both versions prior to 5.2.1716.0.

Zoom is urging customers using these deployments to update to 5.2.1716.0 or later, with administrators advised to follow the steps in the Managing updates for Zoom Node support article to close the gap and treat the patch as an emergency priority.