Is CVE-2026-76060 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-76060?

CVE-2026-76060 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-76060

Description

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.