CISA warns of ZoneMinder flaw that could let authenticated users run commands

CISA on Aug. 25, 2026, warned that an authenticated command injection flaw in ZoneMinder could let a user run operating system commands on affected servers.

The agency said the issue affects ZoneMinder versions 1.37.48 and 1.38.3 and could lead to remote code execution as the web server user. CISA identified the vulnerability as CVE-2026-76060 and said the product is used in information technology environments worldwide.

CISA said the flaw is in ZoneMinder’s event export feature and can be triggered by an authenticated user with View Events permission.

According to the advisory, the exportFile HTTP request parameter is passed unsanitized into a shell command executed through PHP’s exec(). CISA said that design allows arbitrary operating system commands to run on the server.

The agency gave the flaw a CVSS v3.1 base score of 8.8, marked HIGH, with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It also listed a CVSS v4.0 score of 8.7, also HIGH, with the vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

CISA identified CWE-78, or OS command injection, as the weakness class and listed the product status as known_affected.

ZoneMinder recommends upgrading to version 1.38.3 or later. CISA pointed users to the vendor download page, the project’s GitHub repository and a GitHub security advisory for more information.

The advisory says CISA discovered a public proof of concept authored by Scriptkittens and reported it to ZoneMinder. CISA also said no known public exploitation specifically targeting this vulnerability has been reported to the agency at this time.

CISA included general defensive guidance for control systems, including minimizing network exposure, placing systems behind firewalls, using VPNs for remote access and following internal incident reporting procedures.

Operators affected by the flaw should check installed ZoneMinder versions and move to a fixed release or later.

Sources

• CISA Cybersecurity Advisories
• CISA advisory CSAF reference
• ZoneMinder downloads
• ZoneMinder GitHub repository
• ZoneMinder security advisory
• CVE record

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.