Vulnerability · Published Aug 11, 2026 · Assigned by TuranSec

CVE-2026-72556ZoneMinder ZoneMinder - Remote Code Execution

High 8.8

In plain English

A high-severity OS command injection in ZoneMinder from ZoneMinder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.0%top 36.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	zoneminder	no fix listed	DEBIAN-CVE-2026-72556
Debian:13	zoneminder	no fix listed	DEBIAN-CVE-2026-72556
Debian:14	zoneminder	no fix listed	DEBIAN-CVE-2026-72556
Ubuntu:24.04:LTS	zoneminder	no fix listed	UBUNTU-CVE-2026-72556
Ubuntu:26.04:LTS	zoneminder	no fix listed	UBUNTU-CVE-2026-72556
Ubuntu:26.10	zoneminder	no fix listed	UBUNTU-CVE-2026-72556

Affected products (as reported)

Vendor	Product	Versions
ZoneMinder	ZoneMinder	0 – through 1.39.17

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Project Repository