CVE-2026-76060: ZoneMinder OS Command Injection via Event Export — Detection and Remediation Guide

---
title: ZoneMinder Web Server Spawning Shell Interpreter - Possible CVE-2026-76060 Exploitation
id: 3f7a2b91-6c4d-4e58-9a21-8b0c1d2e3f4a
status: experimental
description: Detects the Apache/Nginx/PHP worker process spawning a shell interpreter or common post-exploitation utility on a Linux host. Consistent with OS command injection in web applications such as CVE-2026-76060 in ZoneMinder's event export functionality, where the exportFile parameter is passed unsanitized to a shell.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/08/25
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/php-fpm'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  filter_zoneminder_legit:
    CommandLine|contains:
      - 'zmaudit'
      - 'zmfilter'
      - '/usr/bin/zm'
  condition: selection_parent and selection_child and not filter_zoneminder_legit
falsepositives:
  - Legitimate ZoneMinder maintenance scripts invoked through the web UI; tune the filter to your local zm* binary paths
level: high
---
title: Web Request to ZoneMinder Export Endpoint With Shell Metacharacters
id: 8c1e4d62-3b7a-4f09-b6e5-2a9c0d1e4f5b
status: experimental
description: Detects HTTP requests to ZoneMinder event export functionality containing shell metacharacters or command substitution patterns in the exportFile parameter, indicating attempted exploitation of CVE-2026-76060 OS command injection.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/25
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: linux
detection:
  selection_param:
    cs-uri-query|contains:
      - 'exportFile='
  selection_injection:
    cs-uri-query|contains:
      - '%3B'
      - '%7C'
      - '%26%26'
      - '%24%28'
      - '%60'
      - ';'
      - '|'
      - '&&'
      - '$('
      - '`'
      - '/bin/'
      - 'curl%20'
      - 'wget%20'
  condition: selection_param and selection_injection
falsepositives:
  - Rare; legitimate exportFile values are filenames and should not contain shell metacharacters. Validate against URL-encoded filenames in your environment.
level: high

// Hunt for web server processes spawning shells or downloaders on ZoneMinder hosts
// Works against Defender for Endpoint (if deployed on Linux) and Syslog/CEF-ingested process events
let shellTools = dynamic(["/bin/sh", "/bin/bash", "/bin/dash", "/usr/bin/curl", "/usr/bin/wget", "/bin/nc", "/usr/bin/ncat", "/usr/bin/python3", "/usr/bin/perl", "/usr/bin/base64"]);
let webParents = dynamic(["apache2", "httpd", "php-fpm", "nginx"]);
union isfuzzy=true
    (DeviceProcessEvents
    | where InitiatingProcessFileName in~ (webParents)
    | where FileName in~ (shellTools) or ProcessCommandLine has_any ("curl ", "wget ", "base64 -d", "$(", "`/bin/")
    | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessAccountName),
    (Syslog
    | where SyslogMessage has_any ("exportFile=", "cmd=sh", "cmd=/bin/sh")
    | where SyslogMessage has_any (";", "|", "&&", "$(", "/bin/")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage)
| order by Timestamp desc

-- Hunt for shell/downloader processes parented to the web server (ZoneMinder cmd injection - CVE-2026-76060)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ 'apache2|httpd|php-fpm|nginx'
)
AND (Name =~ '^(sh|bash|dash|curl|wget|nc|ncat|python3?|perl|base64)$'
     OR CommandLine =~ '/bin/(sh|bash)|curl http|wget http|base64 -d')

#!/bin/bash
# CVE-2026-76060 ZoneMinder exposure check and remediation helper
# Run on ZoneMinder hosts. Requires root for package operations.
set -euo pipefail

echo "=== ZoneMinder CVE-2026-76060 Exposure Check ==="

# 1. Identify installed ZoneMinder version
echo "[+] Installed ZoneMinder package version:"
if command -v dpkg >/dev/null 2>&1; then
    dpkg -l | grep -i zoneminder || echo "    ZoneMinder not installed via dpkg"
elif command -v rpm >/dev/null 2>&1; then
    rpm -qa | grep -i zoneminder || echo "    ZoneMinder not installed via rpm"
fi

# 2. Check running version from the web config (if accessible)
echo "[+] Version reported by application (if web server running):"
curl -sk --max-time 5 http://localhost/zm/index.php 2>/dev/null | grep -oiE 'v1\.(37|38)\.[0-9]+' | head -1 || echo "    Unable to determine web version"

# 3. Flag vulnerable versions
echo "[+] Vulnerable versions per ICSA-26-237-02: 1.37.48, 1.38.3"
echo "    ACTION: Update to the latest ZoneMinder release (>1.38.3) immediately."

# 4. Update via package manager (Debian/Ubuntu example - adjust for your repo)
# apt-get update && apt-get install --only-upgrade zoneminder -y

# 5. Hunt for signs of prior exploitation: web server spawning shells
echo "[+] Recent suspicious child processes of web server (last 24h, auditd):"
ausearch -ts recent -k exec 2>/dev/null | grep -iE 'ppid.*(apache2|httpd|php-fpm)' | grep -iE '(\/bin\/sh|\/bin\/bash|curl|wget|nc )' | tail -20 || echo "    auditd key 'exec' not configured or no hits"

# 6. Check web logs for exportFile injection attempts
echo "[+] Scanning Apache logs for exportFile metacharacter injection:"
grep -hE 'exportFile=[^&]*(;|%3B|\||%7C|&&|%26%26|\$\(|%24%28|`|/bin/)' /var/log/apache2/access.log* /var/log/httpd/access_log* 2>/dev/null | tail -20 || echo "    No injection attempts found in available logs"

# 7. Check for dropped web shells in the ZoneMinder webroot
echo "[+] Recently modified .php files in webroot (possible web shells):"
find /usr/share/zoneminder /var/www -name '*.php' -mtime -14 2>/dev/null | head -20 || echo "    None found"

# 8. Network exposure check - is ZoneMinder reachable externally?
echo "[+] Listening web ports (confirm firewall restricts to trusted sources):"
ss -tlnp | grep -E ':(80|443)\b' || echo "    No web listeners found"

echo "=== Check complete. Review findings and apply updates. ==="