CISA issued an ICS advisory for ZoneMinder versions 1.37.48 and 1.38.3 regarding an authenticated OS Command Injection vulnerability (CVE-2026-76060). The flaw exists in ZoneMinder's event export functionality, where the exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(). Any authenticated user with View Events permission can exploit this to execute arbitrary OS commands on the server, resulting in full Remote Code Execution (RCE) as the web server user. The vulnerability carries a CVSS v3.1 score of 8.8 (HIGH) and CVSS v4.0 score of 8.7 (HIGH). CISA discovered a public Proof of Concept (PoC) authored by 'Scriptkittens' and reported it to ZoneMinder. The vendor recommends upgrading to version 1.38.3 or later. Mitigations include minimizing network exposure, using firewalls, and employing VPNs for remote access.
