Skip to content

Command Injection Vulnerability in Zoom Node Multimedia Routers (MMRs)

alt text

CVE-2026-22844 Command Injection CWE-78 CVSS 9.9 Meeting Interception Critical

Overview

A critical command injection vulnerability (CVE-2026-22844) has been discovered in Zoom Node Multimedia Routers (MMRs), the core infrastructure components that enable hybrid conferencing by bridging traditional video conferencing hardware with Zoom's cloud platform. The vulnerability allows authenticated meeting participants with low-level privileges to execute arbitrary operating system commands on vulnerable MMR servers through specially crafted network requests, without requiring any user interaction or administrative access. With a CVSS score of 9.9, this flaw represents one of the most severe security issues affecting Zoom's on-premises infrastructure, potentially exposing thousands of enterprise and government conference rooms to remote code execution attacks.

Zoom Node MMRs serve as critical middleware in enterprise video conferencing architectures, connecting legacy video endpoints (Cisco, Polycom, Lifesize room systems) to Zoom meetings and managing media transcoding, encryption, and routing for hybrid participants. These appliances typically reside within corporate DMZs or conference room VLANs, processing sensitive audio and video streams for board meetings, client presentations, legal proceedings, and classified government briefings. The command injection vulnerability stems from improper input validation when processing meeting participant data, allowing attackers to inject OS-level commands that execute with the privileges of the MMR's application process—often running as root or system administrator on Linux-based appliances.

The attack vector requires only that an attacker join a Zoom meeting using a vulnerable MMR as a bridge for room system participants. Once connected, malicious network packets crafted to exploit the input validation flaw can trigger command execution on the MMR server, providing attackers with a foothold in the target organization's conference room infrastructure. This positioning enables devastating follow-on attacks including real-time interception of confidential meeting audio/video, manipulation of media streams for misinformation campaigns, deployment of persistent backdoors for long-term espionage, and lateral movement to adjacent network segments housing file servers, domain controllers, and other critical infrastructure.

The vulnerability's impact extends beyond individual organizations to affect service providers, managed service platforms, and cloud video infrastructure hosting multiple tenants. Zoom Video Communications disclosed CVE-2026-22844 in January 2026 alongside patches for Zoom Node MMR version 5.2.1716.0 and later. The low attack complexity and minimal privileges required make this vulnerability highly exploitable by threat actors ranging from opportunistic attackers to sophisticated nation-state APT groups targeting high-value communications infrastructure for espionage and disruption operations.

Vulnerability Specifications

Attribute Details
CVE ID CVE-2026-22844
Vulnerability Type OS Command Injection
CWE Classification CWE-78: Improper Neutralization of Special Elements used in an OS Command
Affected Product Zoom Node Multimedia Router (MMR)
Affected Versions All versions prior to 5.2.1716.0
Attack Vector Network (Meeting Participant Access)
Attack Complexity Low
Privileges Required Low (Authenticated Meeting Participant)
User Interaction None
Scope Changed (Compromise extends beyond MMR to network infrastructure)
Confidentiality Impact High (Access to meeting streams, credentials, configuration)
Integrity Impact High (Ability to modify system files, inject malicious code)
Availability Impact High (Disruption of conferencing services)
CVSS 3.1 Base Score 9.9 (Critical)
Public Disclosure Date January 2026
Patch Availability Zoom Node MMR 5.2.1716.0 (January 2026)

Technical Details

Zoom Node MMR Architecture

Zoom Node Multimedia Routers function as protocol gateways and media processors in hybrid conferencing deployments. These appliances bridge legacy video conferencing systems (Cisco, Polycom, Lifesize) with Zoom's cloud infrastructure, handling critical functions including:

  • Protocol Translation: Converting between SIP, H.323, and Zoom's proprietary protocols
  • Media Processing: Transcoding audio/video streams, managing screen sharing relay, and handling encryption/decryption
  • Network Gateway: Connecting corporate conference room VLANs to Zoom cloud services through internet-facing interfaces
  • Administrative Management: Providing web-based configuration interfaces and system diagnostics

MMRs typically operate within corporate DMZs or conference room network segments, processing sensitive communications while maintaining connectivity to both internal legacy systems and external Zoom cloud infrastructure.

Command Injection Vulnerability Mechanics

CVE-2026-22844 stems from improper input validation when the MMR processes network data from meeting participants. Specifically, the vulnerability exists in the handling of participant display names and metadata within SIP/H.323 protocol messages.

Vulnerable Processing Flow:

The MMR accepts participant data through network protocols without adequate sanitization. When constructing system commands for logging, diagnostics, or configuration tasks, the application directly incorporates unsanitized participant-supplied data into command strings. These commands are then executed at the operating system level with the privileges of the MMR application process—typically root or system administrator.

Exploitation Mechanism:

Attackers exploit this flaw by crafting participant display names or protocol fields containing command injection syntax. For example, by including shell metacharacters and commands within participant identification fields, attackers can break out of the intended command context and execute arbitrary operating system commands.

When the MMR processes a malicious meeting join request, the injected commands execute immediately with elevated privileges, providing the attacker with root-level system access. This occurs without requiring any administrative credentials or specialized network positioning—only the ability to join a Zoom meeting using the vulnerable MMR as a bridge.

Common Exploitation Techniques:

  • Reverse Shell Establishment: Injecting commands that create network connections back to attacker-controlled infrastructure
  • Credential Harvesting: Executing commands to extract configuration files, passwords, and API keys stored on the MMR
  • Persistence Mechanisms: Installing backdoors through system service creation, scheduled tasks, or unauthorized user accounts
  • Data Exfiltration: Packaging and transmitting sensitive meeting recordings, logs, and configuration data to external servers

Attack Requirements

Successful exploitation requires minimal attacker capabilities:

  • Network Access: Ability to join Zoom meetings utilizing the target MMR, either through legitimate meeting invitations or publicly accessible meeting links
  • Meeting Credentials: Valid Zoom meeting ID and password (often obtainable through social engineering, calendar scraping, or leaked meeting links)
  • Privileges: Standard meeting participant rights—no administrative access or special permissions required
  • User Interaction: None—exploitation occurs automatically during meeting join processing without alerting other participants or hosts
  • Technical Sophistication: Basic understanding of command injection techniques and network protocols

The low barrier to exploitation makes this vulnerability particularly dangerous, as threat actors ranging from opportunistic attackers to advanced persistent threat groups can readily weaponize the flaw against organizations using vulnerable Zoom Node MMR infrastructure.

Attack Scenario: Law Firm Video Conferencing Espionage Campaign

Scenario Context:

Whitmore & Associates, an AmLaw 100 law firm with 1,200 attorneys across 15 offices, specializes in high-stakes corporate litigation, intellectual property disputes, and M&A due diligence for Fortune 500 clients. The firm invested $4.5M in a hybrid video conferencing infrastructure combining Zoom cloud services with on-premises Zoom Node MMRs to bridge their 87 Cisco and Polycom conference room systems. Their video infrastructure handles 3,500+ meetings monthly, including confidential client consultations, depositions, strategy sessions, and settlement negotiations worth billions of dollars in aggregate.

In November 2025, a sophisticated corporate espionage group (tracked as "LegalLeaks") began targeting law firms representing adversaries in high-value litigation and patent disputes. The threat actors developed exploitation capabilities for CVE-2026-22844 and conducted reconnaissance to identify law firms using vulnerable Zoom Node MMR infrastructure.

Phase 1: Target Identification & Reconnaissance

LegalLeaks identified Whitmore & Associates as handling three high-value cases: a $2.3B pharmaceutical patent infringement lawsuit, a class action securities fraud defense with $800M exposure, and trade secret theft litigation involving autonomous vehicle technology. Open-source intelligence revealed the firm's use of Zoom Node MMRs to support conference room endpoints. Network scanning identified the firm's MMR appliances on their perimeter network.

Phase 2: Initial Exploitation

On December 3, 2025, LegalLeaks targeted a routine case strategy meeting for the pharmaceutical patent litigation involving 8 attorneys, 2 expert witnesses, and 3 client representatives. The attackers joined using a stolen Zoom account and sent a crafted SIP message exploiting CVE-2026-22844 through the participant display name field.

The Zoom Node MMR processed the malicious participant data, executing injected commands with root privileges. Within 30 seconds, the attackers established a reverse shell connection, gained real-time access to audio/video streams of the confidential strategy session, and extracted MMR configuration files containing VPN credentials and Active Directory service account passwords.

Phase 3: Persistence & Infrastructure Compromise

With root access to the MMR, LegalLeaks deployed comprehensive surveillance capabilities including persistent backdoors disguised as legitimate system services, meeting recording implants that automatically captured all conferences, and network enumeration tools for lateral movement. The attackers extracted credentials from MMR configuration files and scanned the internal network to map additional infrastructure targets.

Phase 4: Long-Term Surveillance & Data Exfiltration

Over 12 weeks, the compromised MMR provided LegalLeaks with unprecedented access to the law firm's confidential communications. The attackers intercepted 342 attorney-client privileged meetings across 3 major cases, exfiltrated 89 GB of meeting recordings, and captured 1,247 confidential documents screen-shared during meetings. Client communications, email credentials, and VPN access were harvested from conference room laptops.

Specific high-value intelligence included the complete pharmaceutical patent litigation strategy with settlement parameters, internal investigation findings for the securities fraud defense, and technical specifications of proprietary autonomous driving algorithms from the trade secret case.

The threat actors monetized the intercepted intelligence by selling information to opposing counsel through anonymous intermediaries (\(2.8M), hedge funds for insider trading on settlement announcements (\)4.5M profit), and competitive intelligence firms serving client adversaries ($1.3M).

Phase 5: Detection & Response

After 12 weeks, Whitmore's IT Security team discovered the breach when network monitoring flagged unusual outbound HTTPS traffic from the MMR to an unknown domain. Investigation revealed suspicious system services not present in baseline configurations and meeting recording implants. Forensic analysis uncovered root-level persistence across 4 Zoom Node MMRs in New York, Chicago, Los Angeles, and Houston offices, with continuous surveillance capturing 342 privileged attorney-client meetings and complete exfiltration of video files and credentials.

Impact Assessment

Enterprise Risk Profile

CVE-2026-22844 presents severe risks to organizations relying on Zoom Node MMR infrastructure for hybrid conferencing:

  • Complete System Compromise: Root-level command execution enables full control of MMR appliances
  • Meeting Interception: Real-time access to audio/video streams of confidential meetings
  • Credential Theft: Extraction of VPN credentials, service account passwords, API keys from MMR configuration
  • Lateral Movement: Compromised MMRs serve as pivot points into conference room VLANs and corporate networks
  • Persistent Access: Backdoors survive reboots and basic security scanning
  • Supply Chain Risk: Multi-tenant MMR deployments expose multiple organizations through single vulnerability
  • Confidentiality Breach: Exposure of board meetings, M&A negotiations, legal strategy sessions, financial planning
  • Competitive Intelligence Loss: Adversaries gain access to product roadmaps, pricing strategies, partnership discussions
  • Regulatory Non-Compliance: Violations of attorney-client privilege, HIPAA (telehealth), ITAR (defense contractors)
  • Reputational Damage: Loss of client trust following disclosure of meeting surveillance
  • Operational Disruption: Emergency patching and infrastructure replacement causing conferencing outages
  • Financial Losses: Incident response costs, litigation disadvantages, lost contracts, regulatory fines
  • Legal: Attorney-client privilege breaches, litigation strategy exposure, malpractice claims
  • Healthcare: HIPAA violations from telehealth meeting interceptions, patient privacy breaches
  • Financial Services: SEC violations for M&A intelligence leaks, insider trading facilitation
  • Defense: ITAR violations from classified meeting surveillance, espionage risks
  • Government: Classified information exposure, espionage, policy decision intelligence
  • Enterprise: Trade secret theft, competitive intelligence losses, board meeting surveillance

Meeting Confidentiality Compromise

Zoom Node MMRs process highly sensitive communications across diverse organizational contexts:

High-Value Meeting Types at Risk:

  • Executive Board Meetings: Strategic planning, financial performance, executive compensation, succession planning
  • Legal Consultations: Attorney-client privileged discussions, litigation strategies, settlement negotiations
  • M&A Negotiations: Deal terms, due diligence findings, valuation discussions, integration planning
  • Healthcare Consultations: Telehealth sessions, patient diagnosis discussions, treatment planning
  • Government Deliberations: Policy decisions, classified briefings, diplomatic negotiations
  • Financial Planning: Investment strategies, trading discussions, client portfolio reviews

Threat Actor Interest:

  • Corporate Espionage: Competitors seeking trade secrets, product roadmaps, pricing strategies
  • Nation-State APTs: Intelligence agencies targeting government communications, defense contractor meetings
  • Financially Motivated: Insider trading schemes leveraging M&A intelligence, earnings preview leaks
  • Litigation Adversaries: Opposing parties gaining strategic advantages from intercepted legal strategy sessions
  • Activist Investors: Hedge funds seeking advance knowledge of corporate strategy, financial performance

Mitigation Strategies

Immediate Actions (Emergency Response)

Priority 1: Patch Deployment

Organizations must immediately upgrade all Zoom Node MMR appliances to version 5.2.1716.0 or later. Begin by identifying all MMR appliances through asset inventory reviews and network scanning. Verify the current version of each appliance by accessing the administrative interface or command-line interface. Download the latest software version from the Zoom Download Center and apply upgrades through either the web-based administration interface or command-line tools. Document all patching activities including appliance identifiers, version transitions, and completion dates.

Priority 2: Network Isolation

Restrict network access to MMR appliances using firewall rules and access control lists. Limit administrative access (web interface and SSH) to designated management networks only. Permit conference room endpoints to access only necessary SIP and H.323 ports. Block all unauthorized inbound connections and log denied access attempts for security monitoring.

Priority 3: Threat Hunting

Conduct comprehensive forensic analysis of all MMR appliances to detect potential compromise indicators. Examine running processes for suspicious network connections or unauthorized command execution. Review system service configurations for unauthorized additions or modifications. Analyze user accounts for unexpected administrative accounts or privilege escalations. Inspect temporary directories for hidden files or suspicious scripts. Examine system logs for command injection patterns including shell commands, network utilities, or suspicious file operations. Document all findings and escalate anomalies to incident response teams.

Long-Term Security Enhancements

1. Input Validation & Security Hardening

After patching to version 5.2.1716.0 or later, implement additional security hardening measures. Disable unnecessary system services to reduce attack surface. Configure host-based firewall rules restricting access to essential ports only. Enable comprehensive audit logging for binary execution, configuration changes, and log access. Configure centralized log forwarding to security information and event management (SIEM) systems for continuous monitoring.

2. Meeting Security Controls

Implement organizational policies restricting meeting participant capabilities through Zoom administrative settings. Enable waiting rooms for all meetings to control participant admission. Require meeting passwords for all scheduled and instant meetings. Disable participant video and audio by default with host-controlled unmuting. Restrict screen sharing, annotations, and remote control features to meeting hosts only. Require authentication for meeting access. Disable risky features including breakout rooms, whiteboards, and file sharing that could provide additional attack vectors.

3. Network Segmentation & Monitoring

Deploy comprehensive network monitoring specifically targeting MMR infrastructure. Implement SIEM detection rules monitoring for command injection indicators in system logs including suspicious commands, unauthorized process execution, and unusual network connections. Configure alerting for unauthorized outbound connections from MMR appliances. Establish network flow monitoring detecting data exfiltration attempts. Define security baselines for normal MMR behavior and alert on deviations.

Resources

Security Research & Analysis

Last Updated: January 22, 2026