Zoneminder

1. Executive summary

CVE-2026-76060 is an authenticated OS command-injection vulnerability in ZoneMinder’s event-export function. CISA reports CVSS v3.1 8.8 HIGH and CVSS v4.0 8.7 HIGH: a user with View Events permission can place operating-system commands in the exportFile HTTP parameter, which reaches PHP exec() unsanitised and executes as the web-server user. A public proof of concept exists, but CISA reported no known public exploitation specifically targeting the vulnerability as of 25 August 2026; no CISA KEV state was resolved in the supplied verified-reference data and it must therefore remain unresolved, not inferred as “not listed.” EMEA financial-services organisations operating ZoneMinder should upgrade to version 1.38.3 or later and remove unnecessary network and account-level access immediately; organisations without ZoneMinder have no direct exposure.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

This is a confirmed vulnerability path, not an observed intrusion chain:

1. Access prerequisite: The attacker authenticates to the ZoneMinder web application using an account with View Events permission. The CVSS vectors record network access, low attack complexity, low privileges and no user interaction.
2. Injection: The attacker submits an event-export HTTP request containing operating-system command content in the exportFile parameter.
3. Unsafe command construction: ZoneMinder passes exportFile unsanitised into a shell command executed through PHP exec(). CISA classifies this as CWE-78: Improper Neutralization of Special Elements used in an OS Command.
4. Execution: The injected command executes with the privileges of the web-server user. CISA describes the result as full remote code execution, but the initial execution context remains the web-server account.

CISA reports:

• CVSS v3.1: 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• CVSS v4.0: 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
• CISA KEV state: Unresolved in the supplied verified-reference data.
• Observed exploitation: None known to CISA at publication.
• Exploit availability: CISA states that it discovered a public proof of concept.

The supplied CISA rendering records the affected version expression as 1.37.48|1.38.3 and known_affected, while the remediation text identifies 1.38.3 or later as fixed. This version notation is internally ambiguous and should not be expanded into an assumed range; validate uncertain builds against the vendor advisory and upgrade candidate affected systems to 1.38.3 or later.

No source material identifies a delivered payload, malware family, persistence mechanism, privilege escalation, command-and-control infrastructure, lateral movement, exfiltration method or realised operational impact. These are possible post-exploitation outcomes of command execution but are not confirmed here.

CISA names Scriptkittens only as the public-PoC author. This does not establish malicious exploitation or actor attribution. No MITRE actor profile is supplied, so any attribution would be unconfirmed.

The primary and external excerpts are duplicate representations of the same CISA advisory, not independent corroboration. The vulnerability, PoC and version claims are therefore single-sourced; verify before enforcement.

4. Mitigation & containment

P1 — within 24 hours

• Identify all ZoneMinder deployments, their installed versions, network exposure and accounts holding View Events permission.
• Upgrade candidate affected installations to ZoneMinder 1.38.3 or later using the vendor downloads or official source repository.
• Remove direct internet access. Place the application behind firewalls and restrict the web interface to explicitly authorised networks.
• Isolate ZoneMinder systems from business networks. Require an up-to-date VPN for necessary remote access.
• Until upgraded, remove View Events permission from accounts that do not operationally require it and suspend unnecessary accounts.
• If suspicious activity is already present, isolate the host and preserve web, application, authentication and process telemetry before remediation.

P2 — within 72 hours

• Confirm that every remediated host reports version 1.38.3 or later.
• Review available web and application logs for event-export requests involving exportFile, particularly requests associated with unexpected input or unusual authenticated users.
• Correlate those requests with process telemetry for commands launched by the PHP/web-server context.
• Examine affected hosts for unauthorised file changes, altered ZoneMinder data or configuration, unexpected processes and abnormal outbound connections.
• Treat evidence of command execution as an incident: patching does not remove payloads or persistence that may already have been established.

P3 — within seven days

• Reconcile CISA’s ambiguous affected-version notation with the vendor advisory and document the decision for every installed build.
• Enforce least privilege for event viewing and export functions.
• Maintain firewall separation between ZoneMinder, user networks and sensitive business systems.
• Validate that central logging captures authentication, event-export requests and child-process activity from the web-server account.
• Test the upgrade under normal change controls and retain a supported update process for future ZoneMinder releases.

The supplied material provides no vendor-specific package command, file path, configuration key, port or event-export route. Do not deploy unverified commands or URL matchers based on assumptions.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

These behavioural indicators originate from one CISA advisory and are single-sourced; verify before enforcement.

6. Detection

Insufficient indicators to author detection rules.

7. Sources

• CISA, “Zoneminder — ICSA-26-237-02,” https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02, 2026-08-25.
• ZoneMinder, “GHSA-88m4-hrgp-m9v3,” https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3, date not provided in the supplied material.
• ZoneMinder, “Downloads,” https://zoneminder.com/downloads, date not provided in the supplied material.

8. Adverse Trace position

CVE-2026-76060 is HIGH, using CISA’s reported CVSS v3.1 score of 8.8 and CVSS v4.0 score of 8.7 without independent re-assessment. The client impact is material where ZoneMinder is deployed because a low-privileged authenticated user with View Events access can execute commands as the web-server user; exposure beyond that account depends on local permissions and segmentation. The CISA KEV state remains unresolved in the supplied verified-reference data: a public PoC exists, but CISA reported no known public exploitation, and no actor attribution is supported. The central claims are single-sourced; verify before enforcement. Adverse Trace will monitor for KEV status changes, confirmed exploitation, vendor clarification of affected versions and actionable indicators.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.