InfoSecBulletin Cybersecurity for mankind
A critical command injection flaw in Node Multimedia Routers (MMRs) may let meeting participants run arbitrary code on vulnerable systems. CVE-2026-22844 is a highly critical vulnerability with a CVSS score of 9.9, indicating an urgent need for immediate action.
Zoom Command Injection Vulnerability:
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
A command injection flaw is found in Zoom Node MMR versions prior to 5.2.1716.0, impacting Zoom Node Meetings Hybrid (ZMH) and Zoom Node Meeting Connector (MC) setups. The vulnerability requires only network access and low-level privileges to exploit, with no user interaction necessary.
The vulnerability targets MMR modules running versions earlier than 5.2.1716.0, so identifying and patching these versions is crucial. Zoom’s Offensive Security team discovered this issue.
Zoom urges administrators to promptly update MMR modules to version 5.2.1716.0 or later.
The company released guidance in its Managing Updates for Zoom Node support documentation, offering step-by-step instructions for patching Zoom Node infrastructure.
