What is CVE-2026-72556?
A critical remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute arbitrary OS commands by exploiting broken permission checks in the Filter class, where `canEdit()` and `canDelete()` methods invoke non-existent methods on the `ZM\User` class, causing PHP's `__call()` to return a truthy value. Upgrade ZoneMinder to the latest patched version immediately.
Azərbaycanca: ZoneMinder 1.39.17-də aşkar edilmiş bu kritik boşluq autentifikasiya olunmuş istifadəçilərə Filter klasında zədələnmiş `canEdit()`/`canDelete()` metodları vasitəsilə PHP-nin `__call()` funksiyasını istismar edərək serverdə ixtiyari OS əmrləri icra etməyə imkan verir. Dərhal ZoneMinder instansiyanızı ən son versiyaya yeniləməlisiniz.
Related CVEs
link basis: same weakness class CWE-863
FAQ2
Which version of ZoneMinder is affected by CVE-2026-72556?
This critical vulnerability affects ZoneMinder version 1.39.17.
Does exploiting CVE-2026-72556 require authentication?
Yes, exploiting this vulnerability requires the attacker to have an authenticated user account on ZoneMinder.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.