Zoneminder

View CSAF Summary Successful exploitation of this vulnerability could result in full Remote Code Execution (RCE) as the web server user. The following versions of Zoneminder are affected: Zoneminder 1.37.48|1.38.3 CVSS Vendor Equipment Vulnerabilities v3 8.8 Zoneminder Zoneminder Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Background Critical Infrast

Back to dashboard

Threat HighSingle SourceAgencyConf ConfirmedUnited States · North AmericaPublishedStatus: PublishedCERTOpen original source

Original publisher

CERT

Original source URL

https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02

Source country

United States

Reporting region

North America

Language

Institution

CISA US-CERT

Published (UTC)

Aug 25, 2026, 12:00 PM

Ingested (UTC)

Aug 28, 2026, 4:35 AM

Verification

Single Source

BASE INTEL aggregates public reporting. This item is not authored by BASE INTEL. Always review the original publisher before relying on the content.

Zoneminder
Advisory ID: icsa-26-237-02
View CSAF Summary Successful exploitation of this vulnerability could result in full Remote Code Execution (RCE) as the web server user. The following versions of Zoneminder are affected: Zoneminder 1.37.48|1.38.3  CVSS Vendor Equipment Vulnerabilities v3 8.8 Zoneminder Zoneminder Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Background Critical Infrast
Severity: high
Published (UTC): 2026-08-25T12:00:00.000Z
Source: CERT
Original source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02

View original source