CVE-2026-72556
Received Received - Intake

Remote Code Execution in ZoneMinder

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72556
EUVD
EUVD-2026-56026

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zoneminder zoneminder 1.39.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a remote code execution flaw in ZoneMinder 1.39.17. It allows any authenticated user to run operating system commands by bypassing permission checks. The issue occurs because the Filter class calls non-existent methods on the ZM\User class, which tricks PHP into returning a truthy value. This bypasses normal role-based restrictions, letting any logged-in user execute commands regardless of their assigned permissions.

Detection Guidance

Check ZoneMinder logs for unauthorized filter modifications or command executions. Look for PHP errors related to ZM\User class method calls. Inspect network traffic for suspicious outbound connections from the ZoneMinder server.

Impact Analysis

If you use ZoneMinder 1.39.17, an attacker with valid login credentials could take full control of your system. They could install malware, steal data, or disrupt camera feeds. Since the flaw allows command execution, attackers might pivot to other systems on your network or use the compromised device as a launch point for further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive video feeds and data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face fines or penalties if they fail to secure personal data captured by ZoneMinder against such exploits.

Mitigation Strategies

Upgrade ZoneMinder to the latest patched version immediately. Remove write permissions for non-admin users on filter configurations. Monitor user activity for unusual filter changes. Disable remote access if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72556. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart