CVE-2026-22844
Zoom Node Deployments - Command Injection
9.9
CRITICAL
CVSS 3.1
EPSS 13.6% · 96th pctCWE-78
2026-01-20
Description
A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access.
Severity
CVSS 3.1 · CNA9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSSVC · CISA-ADP
Exploitationnone
Automatableno
Technical impacttotal
Exploitation Context
as of October 14, 2026- Its current EPSS score (13.6%) is higher than that of 29% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Zoom Communications Inc. | Zoom Communications Inc. Zoom Node | 0 to <5.2.1716.0 |
References
1 LinksOther references
Record Details
Published
2026-01-20
Last updated
2026-01-20
Assigner (CNA)
Zoom
Credited to
-
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.