As reported by CISA in advisory ICSA-26-237-02, ZoneMinder versions 1.37.48 through 1.38.3 contain an authenticated OS command injection vulnerability (CVE-2026-76060) in the event export functionality that enables full remote code execution as the web server user. A public proof-of-concept authored by researcher Scriptkittens has already been identified, meaning exploitation tooling is in the wild.

Security Impact: As reported by CISA in advisory ICSA-26-237-02, ZoneMinder versions 1.37.48 through 1.38.3 contain an authenticated OS command injection vulnerability (CVE-2026-76060) in the event export functionality that enables full remote code execution as the web server user.

Vulnerability Details

FieldDetail
CVECVE-2026-76060
CVSS v3.18.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.08.7 HIGH
CWECWE-78 (OS Command Injection)
Affected VersionsZoneMinder 1.37.48 – 1.38.3
VendorZoneMinder (open-source, US-headquartered)
Patch StatusUpgrade to 1.38.3 or later per vendor advisory
Active ExploitationPublic PoC available; in-the-wild exploitation likely imminent
Authentication RequiredYes — any user with View Events permission

Why This Matters More Than the CVSS Suggests

The CVSS 8.8 rating, while appropriately High, understates the real-world risk for one critical reason: ZoneMinder deployments are overwhelmingly internet-facing. The software exists to provide remote access to surveillance camera feeds, and its user base skews toward home enthusiasts, small businesses, and facilities teams who frequently expose the web interface directly to the internet without a VPN or reverse proxy in front.

The vulnerability requires authentication, but only at the View Events permission level — one of the lowest privileged tiers in ZoneMinder's role hierarchy. In practice, many deployments use shared or weak credentials for camera monitoring stations, and default configurations may grant this permission broadly. Combined with the public PoC, the barrier to exploitation is effectively trivial for anyone who can guess or brute-force a low-privilege account.

The attack chain is simple: authenticate with any View Events user, send a crafted exportFile parameter in the event export request, and achieve command execution as the web server user. From there, lateral movement into the underlying Linux host is straightforward given typical ZoneMinder deployment hardening — or lack thereof.

Who Is Most Exposed

Why This Matters More Than the CVSS Suggests
SOHO and SMB surveillance deployments — rarely hardened, frequently internet-exposed, often running on outdated Ubuntu/Debian servers with minimal patching discipline
Facilities and physical security teams in education, municipal, and healthcare environments where ZoneMinder is chosen as a cost-effective NVR alternative
Industrial environments where ZoneMinder may monitor perimeter or operational areas and share network segments with OT assets
Hosting providers and homelab enthusiasts running ZoneMinder in containers or VMs with excessive host privileges

Broader Implications

This vulnerability highlights a recurring pattern in open-source video surveillance software: PHP-based web interfaces that pass user input directly to exec() without adequate sanitization. ZoneMinder is not unique — similar command injection flaws have appeared in Blue Iris clones, Xeoma web modules, and other NVR platforms. Organizations should view this as a systemic risk category rather than a single-vendor issue.

The presence of a public PoC before the advisory publication also raises questions about disclosure timelines. CISA's acknowledgment that they discovered an already-public PoC and reported it suggests the vulnerability may have been circulating in exploit forums before formal coordination completed.

Shield53 Recommendations

Immediate Actions

  • Patch now: Upgrade to ZoneMinder 1.38.3 or later from the official downloads page or the GitHub repository. Verify the upgrade completed successfully by checking the version in the web interface.
  • Remove internet exposure: If the ZoneMinder web interface is publicly accessible, place it behind a VPN or restrict access via IP allowlisting at the firewall immediately. There is no good reason for a surveillance management interface to be internet-facing.
  • Audit user accounts: Review all authenticated users and remove or downgrade unnecessary View Events permissions. Disable default or shared accounts. Enforce strong passwords and consider integrating LDAP/OIDC if available.
  • Deploy WAF rules: If you cannot patch immediately, deploy a WAF rule to block requests to the export endpoint containing shell metacharacters (; | & $ ` ( ) { }) in the exportFile parameter. This is a stopgap, not a fix.
  • Hunt for compromise: Check the ZoneMinder server's command history, cron jobs, and web server error logs for signs of post-exploitation activity. Look for unexpected outbound connections, new user accounts, or modified PHP files in the ZoneMinder web root.
  • Contain the blast radius: Ensure the ZoneMinder web server process runs as a dedicated low-privilege user with no sudo access and no ability to reach OT network segments. If it currently runs as root or a privileged user, remediate this configuration.

Longer-Term Hardening

  • Implement network segmentation between surveillance infrastructure and corporate/OT networks
  • Establish a vulnerability scanning cadence for all surveillance and physical security systems — these are frequently orphaned from IT patching cycles
  • Standardize on a reverse proxy with authentication in front of all surveillance web interfaces