Quick Summary
Zoom and GitLab have released security updates to fix vulnerabilities that could lead to denial-of-service (DoS) and remote code execution attacks. The most critical flaw, CVE-2026-22844, affects Zoom Node Multimedia Routers (MMRs) with a CVSS score of 9.9. GitLab also patched multiple high-severity flaws, including CVE-2025-13927 and CVE-2025-13928, which could allow unauthenticated users to create DoS conditions. These updates are essential for protecting users and organizations from potential exploitation.
The Securityish Brief
Zoom and GitLab have taken significant steps to enhance their security by releasing updates that address several vulnerabilities. Zoom’s critical flaw, tracked as CVE-2026-22844, affects its Node Multimedia Routers (MMRs) before version 5.2.1716.0. This vulnerability allows a meeting participant to execute remote code, posing a severe risk to users. Fortunately, there is no evidence that this flaw has been exploited in the wild.
GitLab has also issued patches for multiple vulnerabilities in its Community Edition (CE) and Enterprise Edition (EE). These include CVE-2025-13927 and CVE-2025-13928, both with a CVSS score of 7.5, which could allow unauthenticated users to create DoS conditions. Additionally, CVE-2026-0723 could enable a bypass of two-factor authentication (2FA) protections.
Understanding the Vulnerabilities
The vulnerabilities in GitLab affect versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2. The flaws could be exploited by sending crafted requests or forging device responses, highlighting the importance of keeping software up to date. GitLab also addressed two medium-severity bugs, CVE-2025-13335 and CVE-2026-1102, which could trigger DoS conditions.
These updates are crucial for organizations that rely on Zoom and GitLab for their operations. The potential for remote code execution and DoS attacks can severely disrupt services and compromise sensitive data. Users should prioritize updating their systems to mitigate these risks.
As cyber threats continue to evolve, the proactive measures taken by Zoom and GitLab reflect the need for ongoing vigilance in cybersecurity practices. Organizations must regularly monitor their software for updates and apply patches promptly to protect against emerging vulnerabilities.
- CVE-2026-22844 – A critical command injection vulnerability in Zoom Node Multimedia Routers allowing remote code execution.
- CVE-2025-13927 – A vulnerability in GitLab that could allow unauthenticated users to create a DoS condition.
- CVE-2025-13928 – An incorrect authorization vulnerability in GitLab’s Releases API that could lead to a DoS condition.
- CVE-2026-0723 – A vulnerability in GitLab allowing bypass of 2FA protections by submitting forged device responses.
- CVE-2025-13335 – A medium-severity bug in GitLab that could trigger a DoS condition through malformed Wiki documents.
- CVE-2026-1102 – A medium-severity bug in GitLab that could cause a DoS condition via malformed SSH authentication requests.
Key Takeaways
- Update your Zoom Node Multimedia Routers to version 5.2.1716.0 or later to fix critical vulnerabilities.
- Ensure your GitLab installations are updated to version 18.8.2 or later to protect against DoS and 2FA bypass vulnerabilities.
- Regularly check for security updates from software vendors to mitigate potential risks.
- Implement monitoring practices to detect unusual activity that may indicate exploitation attempts.
- Educate your team about the importance of cybersecurity hygiene, including timely software updates.
Key Terms & Concepts
- CVE: CVE refers to a Common Vulnerabilities and Exposures identifier used to catalog security vulnerabilities.
- DoS: DoS stands for Denial of Service, a type of attack that aims to make a service unavailable to its intended users.
- 2FA: 2FA, or two-factor authentication, is a security process that requires two different forms of identification to access an account.
Read the original article here: https://thehackernews.com/2026/01/zoom-and-gitlab-release-security.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
