DNA View

Critical Severity Vulnerability

This vulnerability has been rated as Critical severity. Immediate action is recommended.

CVE-2026-22844

Critical

Low Medium High Critical

9.9

CVSS Score

Published: Jan 20, 2026

Last Modified: Jan 26, 2026

CWE: CWE-78

Vulnerability Description

A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

References & Resources

https://www.zoom.com/en/trust/security-bulletin/zsb-26001
security@zoom.us

Severity Details

9.9

out of 10.0

Critical

Weakness Type (CWE)

CWE-78 Top 25 #13

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a…
Exploit Likelihood: High
Typical Severity: High
OWASP Top 10: A03:2021-Injection
Abstraction Level: Base