Quick answers
- Is CVE-2026-0804 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-0804 being exploited in the wild.
- How severe is CVE-2026-0804?
- Medium severity, with a CVSS score of 6.7, published 12 May 2026.
- Which products and versions are affected?
- Axis Communications OS 12.0.0 to 12.10.4.
- Is there a fix for CVE-2026-0804?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-0804 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-0804?
- Check whether you run Axis Os, Axis Communications ACAP or Axis Communications OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability (CWE-35) exists in the ACAP (AXIS Camera Application Platform) configuration file due to insufficient input validation. An attacker can exploit this by creating a malicious ACAP application that uses path traversal sequences to access or modify restricted files. Successful exploitation requires the target Axis device to be configured to allow the installation of unsigned ACAP applications and requires the attacker to trick an authorized user into installing the malicious package. This can result in local privilege escalation, granting the attacker elevated permissions on the AXIS OS.
Affected products
- Axis Communications AXIS OS 12.0.0 to 12.10.4
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory