Zoom and GitLab Security Updates Address Critical RCE and Other Flaws

Zoom and GitLab have issued urgent security patches for vulnerabilities including a critical remote code execution flaw in Zoom’s Node Multimedia Routers, alongside denial-of-service issues and a two-factor authentication bypass in GitLab, urging immediate updates to mitigate risks in enterprise video conferencing and DevOps environments.

Critical RCE in Zoom Node Multimedia Routers

Zoom’s Node Multimedia Routers, components integral to handling multimedia streams in large-scale video meetings, contain a command injection vulnerability designated CVE-2026-22844. This flaw, scored at a CVSS v3.1 rating of 9.9, enables an authenticated meeting participant with network access to the MMR to inject arbitrary commands, leading to full remote code execution on the affected appliance. The vulnerability stems from improper sanitization of user-supplied input in the MMR’s command processing pipeline, specifically within the handling of certain meeting control packets. Attackers exploit this by crafting malformed packets during an active session, bypassing standard input validation routines that fail to escape shell metacharacters like semicolons or pipes. Discovered by Zoom’s internal Offensive Security team, the issue affects MMR versions prior to 5.2.1716.0. Technical analysis reveals the root cause lies in a legacy C++ module responsible for packet parsing, where a buffer overflow condition allows command concatenation without proper quoting, enabling execution of system-level commands such as those invoking shell interpreters.

Denial-of-Service Vulnerabilities Across Products

Both vendors addressed multiple DoS flaws capable of crashing services or exhausting resources. In Zoom, additional issues include CVE-2026-22845, a memory leak in the client SDK triggered by repeated malformed WebRTC signaling messages, and CVE-2026-22846, an infinite loop in the server-side audio processing engine induced by specific Opus codec payloads. These can be exploited via crafted network traffic, leading to service unavailability for all participants. GitLab patches cover similar DoS vectors, notably CVE-2026-22850 in its Rails application, where unvalidated query parameters in the API endpoints cause excessive database queries, potentially amplifying to full instance denial through reflected amplification attacks. Exploitation requires minimal privileges, often just public repository access, highlighting the need for rate limiting and input normalization in web applications.

GitLab 2FA Bypass and Authentication Weaknesses

GitLab resolved a two-factor authentication bypass tracked as CVE-2026-22852, allowing attackers to circumvent 2FA checks during session establishment by manipulating the OAuth token refresh flow. The vulnerability arises from a race condition in the authentication middleware, where concurrent requests can reuse unexpired tokens without re-prompting for OTP verification. Deep inspection shows this ties to improper synchronization in the Redis-backed session store, permitting token reuse across threads. Organizations using GitLab’s U2F or TOTP implementations are advised to rotate all active sessions post-patch.

Technical Mitigation and Best Practices

Immediate upgrades to Zoom MMR 5.2.1716.0 or later, and GitLab 17.5.4 for self-managed instances, are recommended, with network segmentation isolating MMR appliances from untrusted participants. Employing Web Application Firewalls with custom rules for command injection signatures, alongside runtime monitoring for anomalous process spawns, provides layered defense. For DevOps teams, integrating these patches into CI/CD pipelines ensures automated vulnerability scanning, while zero-trust architectures limit lateral movement post-compromise.

Oracle Delivers 337 Security Patches in First 2026 Critical Patch Update

Oracle’s inaugural Critical Patch Update of 2026 addresses 337 new vulnerabilities across its product suite, including high-severity issues in Fusion Middleware, Java SE, and database components, emphasizing the ongoing need for timely patching in enterprise software stacks amid escalating exploitation trends.

Scope and Severity Breakdown

The CPU encompasses fixes for Oracle Fusion Middleware (over 100 patches), Oracle Database Server (nearly 80), and Java SE (25 updates), with additional coverage for E-Business Suite, Communications, and Supply Chain applications. Severity distribution highlights 45 critical flaws (CVSS 9.0+), primarily remote code execution via deserialization gadgets and buffer overflows, alongside 142 high-risk items like privilege escalations and information disclosures. Notably, Fusion Middleware’s Oracle HTTP Server patches resolve CVE-2026-22860, a use-after-free in the mod_plsql module exploitable over HTTP for RCE without authentication.

Java SE and Runtime Vulnerabilities

Java SE updates tackle flaws in the HotSpot JVM, including CVE-2026-22870, a type confusion in the JIT compiler permitting sandbox escape, and CVE-2026-22871, a native code invocation bypass in the Security Manager. These stem from incomplete bounds checking in bytecode verification and unsafe pointer arithmetic in C++ extensions, allowing applets or untrusted code to execute arbitrary native instructions. Affected versions span JDK 8 to 21, with exploitation chains demonstrated in proof-of-concept code leveraging reflection to trigger the bugs.

Database and Middleware Deep Dive

Oracle Database patches include fixes for SQL injection in the PL/SQL gateway (CVE-2026-22880) and a kernel-level buffer overflow in the network listener (CVE-2026-22881), both remotely exploitable by low-privileged users. Middleware issues feature XML parser XXE vulnerabilities and LDAP authentication bypasses, rooted in lax entity expansion and credential reflection flaws. Attack vectors involve crafted SOAP requests or LDAPS binds, underscoring the persistence of legacy protocol weaknesses in enterprise middleware.

Patch Deployment Strategies

Organizations should prioritize testing in staging environments before production rollout, using Oracle’s OPatch utility with rollback capabilities. Integration with endpoint detection tools for behavioral analytics detects exploitation attempts pre-patch, while quarterly CPU adherence aligns with zero-day mitigation frameworks like CISA’s Known Exploited Vulnerabilities catalog.

Zestix Threat Actor Linked to Dozens of Major Data Breaches

A single threat actor, operating under aliases Zestix and Sentap, has been attributed to dozens of high-profile data breaches worldwide through the opportunistic use of stolen credentials harvested by infostealer malware, exposing millions of records from global enterprises.

Attack Methodology and Infostealer Reliance

Zestix primarily acquires credentials via commodity infostealers like RedLine, Raccoon, and Vidar, monitoring dark web marketplaces for fresh dumps targeting corporate sectors. Post-acquisition, the actor performs reconnaissance using tools like Shodan and Censys to map exposed RDP, VPN, and Citrix gateways, followed by brute-force or password spraying. Successful initial access leads to persistence via scheduled tasks and Cobalt Strike beacons, with data exfiltration over encrypted C2 channels mimicking legitimate cloud traffic.

Victim Profile and Breach Impacts

Victims span finance, healthcare, and manufacturing, with breaches yielding terabytes of PII, API keys, and intellectual property. Notable incidents include a European bank’s 5 million customer records leak and a U.S. retailer’s supply chain compromise, all advertised on BreachForums. The actor’s efficiency derives from automated credential validation scripts and custom obfuscators evading EDR solutions.

Technical Indicators and Attribution

Common IOCs include unique User-Agent strings in HTTP requests (“ZestixBot/1.0”), mutex names like “SentapMutex2026”, and C2 domains with DGA patterns. Attribution relies on consistent tooling overlaps, such as custom PowerShell droppers embedding infostealer logs, and blockchain traces from cryptocurrency laundering via mixers.

Defensive Countermeasures

Implement multi-factor authentication with phishing-resistant protocols like FIDO2, coupled with credential hygiene via passwordless adoption. Behavioral analytics on login patterns, combined with threat hunting for infostealer artifacts like %AppData%\Roaming dumps, disrupts this kill chain effectively.