Automatically Discover and Remediate WhatsApp Vulnerabilities Using VMDR Mobile | Qualys
Summary: WhatsApp has patched critical and high-severity vulnerabilities across WhatsApp and WhatsApp Business on Android and iOS, including CVE-2022-36934, a remote code execution flaw with a CVSSv3 score of 9.8, and CVE-2022-27492, an RCE flaw scored 7.8 that could be triggered when a user plays a crafted video file. Qualys says its VMDR Mobile can identify affected devices through the Cloud Agent for Android or iOS, detect the flaws via QID 630827, and orchestrate patching on Android or send update instructions to iOS users.
What's compelling: A 9.8 RCE in a messaging app that employees run on personal and corporate phones is the entry point an attacker needs to install malware, and the 2019 NSO Group Pegasus case shows that path has already been used against real targets.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-27492CVE-2022-36934
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026