CVE-2026-104198 ZoneMinder CVE debrief

Who should care

Defenders responsible for ZoneMinder installations should assess their exposure and prioritize upgrading to version 1.36.63 or later. They should also review the official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, defenders should verify their ZoneMinder installations and monitor ZoneMinder systems for unauthorized access.

Why it matters

The CVE-2026-104198 vulnerability in ZoneMinder allows an attacker to bypass web authentication and access certain views, potentially disclosing monitor and zone metadata. Defenders should prioritize verifying their ZoneMinder installations and upgrading to version 1.36.63 or later.

• An attacker can bypass web authentication and access certain views, such as the zones view.
• The vulnerability can result in the disclosure of monitor and zone metadata.
• Defenders should verify their ZoneMinder installations and upgrade to version 1.36.63 or later.
• The vulnerability requires verification of ZoneMinder versions and remediation priority.

Technical summary

The ZoneMinder web interface mishandles failed token authentication in web/includes/auth.php, allowing an attacker to bypass web authentication and access certain views, such as the zones view, which discloses monitor and zone metadata. The vulnerability is fixed in version 1.36.63. Defenders should prioritize verifying their ZoneMinder installations and upgrading to version 1.36.63 or later to address this authentication bypass vulnerability. The vulnerability requires verification of ZoneMinder versions and remediation priority.

Defensive priority

Defenders should prioritize verifying their ZoneMinder installations and upgrading to version 1.36.63 or later to address this authentication bypass vulnerability.

Recommended defensive actions

• Verify ZoneMinder installations to determine if they are vulnerable
• Upgrade to version 1.36.63 or later
• Monitor ZoneMinder systems for unauthorized access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The vulnerability is in the web interface's handling of failed token authentication in web/includes/auth.php, allowing an attacker to bypass web authentication and access certain views. Defenders should verify their ZoneMinder installations and review the official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also check relevant monitoring, detection, and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.