Zoom Node MMR Vulnerability Allows Remote Code Execution

Zoom has remediated a critical command injection vulnerability affecting Zoom Node Multimedia Routers (MMRs). The issue impacts Zoom Node Meetings Hybrid (ZMH) MMR module and Zoom Node Meeting Connector (MC) MMR module versions prior to 5.2.1716.0. The vulnerability allows a remote meeting participant to execute arbitrary code on the affected MMR via network access. Successful exploitation could result in compromise of the media routing infrastructure responsible for handling live meeting traffic.

CVE
CVE-2026-22844

Targeting / Delivery Mechanism
The vulnerability may be exploited by a meeting participant with network access to the affected MMR service. By supplying crafted input to the vulnerable component, an attacker can trigger command injection within the MMR environment. Deployments with exposed or insufficiently segmented MMR nodes increase the potential attack surface.

Execution Technique
The flaw is a command injection vulnerability caused by improper input validation. Attacker-controlled input can be interpreted as system-level commands, enabling remote code execution within the context of the MMR service.

Persistence / Deployment
If successfully exploited, an attacker could execute arbitrary commands, deploy additional payloads, modify configurations, or establish persistence on the compromised node, potentially impacting meeting services and connected systems.