InfoSecBulletin Cybersecurity for mankind
A critical command injection flaw in Node Multimedia Routers (MMRs) may let meeting participants run arbitrary code on vulnerable systems. CVE-2026-22844 is a highly critical vulnerability with a CVSS score of 9.9, indicating an urgent need for immediate action.
Zoom Command Injection Vulnerability:
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
A command injection flaw is found in Zoom Node MMR versions prior to 5.2.1716.0, impacting Zoom Node Meetings Hybrid (ZMH) and Zoom Node Meeting Connector (MC) setups. The vulnerability requires only network access and low-level privileges to exploit, with no user interaction necessary.
The vulnerability targets MMR modules running versions earlier than 5.2.1716.0, so identifying and patching these versions is crucial. Zoom’s Offensive Security team discovered this issue.
Zoom urges administrators to promptly update MMR modules to version 5.2.1716.0 or later.
The company released guidance in its Managing Updates for Zoom Node support documentation, offering step-by-step instructions for patching Zoom Node infrastructure.
