Axis
Vulnerability activity for Axis: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 16
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.4MediumMay 12, 2026axis os Privilege escalationCVE-2026-1185A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH.
- 6.7MediumMay 12, 2026axis os Path traversal / file handlingCVE-2026-0804An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
- 6.0MediumMay 12, 2026axis os Code / command injectionCVE-2026-0802An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
- 6.7MediumMay 12, 2026axis os Privilege escalationCVE-2026-0541ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
- 5.7MediumFeb 10, 2026Axis camera station pro Auth bypass / access controlCVE-2025-12063An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.
- 4.5MediumFeb 10, 2026Axis camera station proCVE-2025-13064A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a client that have been tampered with.
- 4.6MediumFeb 10, 2026Axis camera station pro Path traversal / file handlingCVE-2025-12757An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to.
- 7.8HighFeb 10, 2026Axis camera station pro Information disclosureCVE-2025-11547AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.
- 7.1HighFeb 10, 2026axis os Code / command injectionCVE-2025-11142The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.
- 6.7MediumNov 11, 2025axis os Privilege escalationCVE-2025-8108An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
- 6.7MediumNov 11, 2025axis os Privilege escalationCVE-2025-6779An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.1% likely
- 6.7MediumNov 11, 2025axis os Privilege escalationCVE-2025-6298ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
- 6.8MediumNov 11, 2025axis os Path traversal / file handlingCVE-2025-5718The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
- 6.4MediumNov 11, 2025axis os Path traversal / file handlingCVE-2025-5454An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
- 6.6MediumNov 11, 2025axis os Privilege escalationCVE-2025-5452A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
- 6.7MediumNov 11, 2025axis os Code / command injectionCVE-2025-4645An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Top products
- axis os12 CVEs in the last year
- camera station pro4 CVEs in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.