Authenticated OS Command Injection (CVE‑2026‑76060) Enables Remote Code Execution in ZoneMinder 1.37.48/1.38.3
What It Is — An authenticated OS‑command injection flaw in ZoneMinder’s event‑export feature lets a user with the “View Events” permission inject arbitrary shell commands via the exportFile HTTP parameter. Successful exploitation runs code as the web‑server user, giving full remote code execution.
Exploitability — CVSS v3.1 8.8 (High). No public exploit code yet, but the vulnerability is trivial to weaponize once an attacker obtains a low‑privilege account.
Affected Products — ZoneMinder open‑source video‑surveillance software, versions 1.37.48 and 1.38.3.
Why It Matters for Compliance & Audit Readiness
- Reinforces the need for strict access‑control segregation (SOC 2 CC6.1) – even read‑only roles must be limited to the minimum functions.
- Underscores the importance of continuous patch‑management evidence (SOC 2 CC6.2) to demonstrate timely remediation of high‑severity flaws.
- Provides a concrete audit‑ready control test: verifying that privileged‑action logging and command‑execution monitoring are in place for web‑application servers.
Recommended Actions
- Upgrade ZoneMinder to 1.38.3 or later immediately.
- Review and tighten role‑based permissions; ensure “View Events” cannot trigger OS commands.
- Enable comprehensive web‑server command‑execution logging and feed logs into your SIEM for SOC 2 evidence.
- Record the remediation in your change‑management system and retain proof of patch deployment for auditors.
Source: CISA Advisory – ICSA‑26‑237‑02