CVE-2026-72556: ZoneMinder ZoneMinder - Remote Code Execution

Published Aug 11, 2026

Updated

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role.

Affected Software

1 affected component

ZoneMinder Zoneminder=1.39.17

Event History

Aug 11, 2026

CVE Published

via MITRE·11:11 AM

Data Sourced

via MITRE·11:11 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72556?

The severity of CVE-2026-72556 is rated high with a score of 8.8.

How do I fix CVE-2026-72556?

To fix CVE-2026-72556, ensure you update ZoneMinder to the latest version where the vulnerability is patched.

What impact does CVE-2026-72556 have on my system?

CVE-2026-72556 allows authenticated users to execute OS commands, potentially compromising system integrity.

Which versions of ZoneMinder are affected by CVE-2026-72556?

CVE-2026-72556 affects ZoneMinder version 1.39.17.

What type of vulnerability is CVE-2026-72556?

CVE-2026-72556 is categorized as an OS Command Injection vulnerability.