What is the CVSS score of CVE-2026-72556?

CVE-2026-72556 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of ZoneMinder are affected by CVE-2026-72556?

ZoneMinder versions 1.39.17 and earlier have a critical access control flaw that allows any employee or user with system access to execute arbitrary commands on affected servers.

How to fix or mitigate CVE-2026-72556?

Within 24 hours: Identify all ZoneMinder 1.39.17 or earlier instances in production and development environments; restrict network access to administrative and trusted users only; enable all available logging for filter operations and immediately review recent logs for suspicious activity. Within 7 days: Document the complete inventory of affected systems with owner and location details; implement network segmentation to isolate ZoneMinder systems and limit lateral movement; conduct deep review of access logs for the past 30 days for signs of exploitation. Within 30 days: Monitor vendor security advisories for patch availability; prepare and test a detailed migration plan to patched ZoneMinder versions; evaluate operational feasibility of temporarily disabling filter functionality; if patches remain unavailable, assess alternative surveillance platforms and begin procurement process.

ZoneMinder CVE-2026-72556

EUVD-2026-56026 HIGH

OS Command Injection (CWE-78)

2026-08-11 TuranSec

GHSA-9h33-vcjj-9j5m

PHP RCE Command Injection Zoneminder

8.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible web application exploitable by any authenticated account via a trivially bypassed permission check leading to full OS command injection; PR:L reflects the sole barrier being a valid credential.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:11 vuln.today

CVE Published

Aug 11, 2026 - 11:11 cve.org

HIGH 8.8

DescriptionCVE.org

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role.

Articles & Coverage 1

News 6 New PHP Vulnerabilities - 6 High Severity, No Public POC Aug 12, 2026

AnalysisAI

Remote code execution in ZoneMinder 1.39.17 and earlier allows any authenticated user - regardless of assigned role - to execute arbitrary OS commands by exploiting a broken permission check in the Filter class. The flaw arises because canEdit() and canDelete() invoke nonexistent methods on the ZM\User class, causing PHP's __call() magic method to silently return a truthy value and bypass all role-based authorization for filter operations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the extremely low exploitation bar - any valid account suffices - makes this a high-priority remediation target for all ZoneMinder deployments.

Technical ContextAI

ZoneMinder is an open-source PHP-based video surveillance management platform commonly self-hosted on Linux servers. Its Filter class allows users to define event-matching rules that can trigger OS-level commands (archiving, alerting, external scripts), making it a high-value exploitation target. The root cause (CWE-78: Improper Neutralization of Special Elements in OS Commands) is compounded by a PHP-specific behavioral quirk: when canEdit() and canDelete() call methods that do not exist on the ZM\User class, PHP invokes the __call() magic method as a fallback. Rather than throwing an exception or returning false, __call() returns a truthy value in this implementation, causing the permission gate to evaluate as granted for all callers. The affected CPE is cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* covering all versions through 1.39.17 per EUVD-2026-56026.

RemediationAI

No vendor-released patched version has been independently confirmed at time of analysis. Administrators should monitor https://github.com/ZoneMinder/zoneminder for a tagged release that addresses this filter permission bypass. As an immediate compensating control, audit and reduce all ZoneMinder user accounts to the minimum necessary set, since any valid account - including low-privilege roles - is sufficient for exploitation. If filter-based OS command execution is not operationally required, disable or restrict that capability within ZoneMinder's configuration to eliminate the exploitable command injection sink; note this may impact automated archiving or alerting workflows. Restrict network access to the ZoneMinder web interface using a VPN, firewall allowlist, or reverse proxy with IP-based access controls, raising the effective barrier from PR:L to requiring network presence. Monitor application and web server logs for unexpected filter creation, modification, or execution events as a detection measure while a patch is pending.