CVE-2026-76060

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

  • Published Aug 28, 2026
  • CVSS 8.7 high
  • 2.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-76060 at the National Vulnerability Database