ZoneMinder RCE via event export (CVE-2026-76060) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-76060 is a high-severity command injection flaw in ZoneMinder 1.36.x and 1.37.x that lets any authenticated user with View Events permission execute arbitrary operating system commands on the server. Patches are available in 1.36.34 and 1.37.44; update immediately.

Overview

CVE-2026-76060 is an authenticated OS command injection vulnerability in ZoneMinder’s event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP’s exec() function. An attacker who has valid credentials and the View Events permission can inject arbitrary shell commands that execute with the privileges of the web server process, typically www-data or apache.

The vulnerability carries a CVSS score of 8.8 (HIGH) with a network attack vector, low attack complexity, low privileges required, and no user interaction needed. The EPSS model estimates a 2.3% probability of exploitation in the next 30 days. While no active exploitation has been confirmed, the public proof-of-concept lowers the barrier for attackers.

Impact

Successful exploitation grants an attacker full command execution on the ZoneMinder server. This means the attacker can:

• Read or exfiltrate sensitive files, including database credentials and configuration files
• Install persistent backdoors or web shells
• Launch further attacks against the internal network, as the server often sits on a trusted segment
• Disrupt or destroy surveillance footage and system logs

Because ZoneMinder is typically deployed as a security monitoring tool, compromised systems may also expose video feeds, posing a privacy and physical security risk beyond the digital breach.

Remediation

ZoneMinder has released fixes in versions 1.36.34 and 1.37.44. Upgrade to the latest patched release for your branch immediately. If immediate patching is not possible, apply the following mitigations:

• Restrict access to the ZoneMinder web interface to trusted networks or VPN users only
• Enforce strong, unique passwords and enable multi-factor authentication if supported
• Review and limit which accounts hold the View Events permission
• Run ZoneMinder in a container or restricted OS user with minimal filesystem privileges
• Monitor server logs for anomalous exec() calls or unexpected child processes

Security Insight

This vulnerability highlights a recurring pattern in surveillance and IoT management platforms: critical functionality implemented through shell commands instead of safe, parameterized APIs. The fact that a low-privileged authenticated user can reach a command execution primitive suggests that input validation was treated as an afterthought rather than a core design requirement. As camera and monitoring systems become more exposed to the internet, vendors must treat every feature that touches the OS as a potential attack surface. For related coverage, see breach reports and security news.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs