# CVE-2026-1185: Axis AXIS OS privilege escalation via configuration file

Source: https://junglewise.ai/threats/cve-2026-1185-axis-axis-os-privilege-escalation-via-configuration-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-1185 · Severity: medium · CVSS 5.4 · Published 2026-05-12

A vulnerability in Axis network devices, such as security cameras and encoders, could allow an authorized user to gain higher-level system permissions. By modifying a specific configuration file, an attacker who already has SSH access to the device can execute unauthorized code. This could lead to a full takeover of the device, potentially compromising the security of the video surveillance network.

Technologies: [Axis Os](https://junglewise.ai/threats/technologies/axis-os), [Axis Communications OS](https://junglewise.ai/threats/technologies/os). Vendors: [Axis](https://junglewise.ai/threats/vendors/axis), [Axis Communications](https://junglewise.ai/threats/vendors/axis-communications).

## Quick answers

**Is CVE-2026-1185 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1185 being exploited in the wild.

**How severe is CVE-2026-1185?** Medium severity, with a CVSS score of 5.4, published 12 May 2026.

**Which products and versions are affected?** Axis Communications OS 12.0.0 to 12.10.37.

**Is there a fix for CVE-2026-1185?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-1185 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-1185?** Check whether you run Axis Os or Axis Communications OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input validation vulnerability exists in a local configuration file within AXIS OS. The flaw, classified under CWE-732 (Incorrect Permission Assignment for Critical Resource), allows an attacker with existing SSH access and low-level privileges to modify system configurations to execute arbitrary code. This can result in local privilege escalation to a higher-privileged user or root. The attack vector is listed as network-based because SSH is the primary entry point, though it requires valid credentials (PR:L). Axis has addressed this in AXIS OS versions 12.10.37 and later.

## Affected products

- Axis Communications AXIS OS 12.0.0 to 12.10.37

## Timeline

- 2026-05-12: disclosed
- 2026-05-12: advisory
- 2026-05-19: other: NVD analysis updated

## References

- [https://www.axis.com/dam/public/69/df/8d/cve-2026-1185pdf-en-US-530733.pdf](https://www.axis.com/dam/public/69/df/8d/cve-2026-1185pdf-en-US-530733.pdf)

## Related threats

- [Axis AXIS OS path traversal in ACAP configuration](https://junglewise.ai/threats/cve-2026-0804-axis-axis-os-path-traversal-in-acap-configuration)
- [Axis AXIS OS command injection in ACAP configuration file](https://junglewise.ai/threats/cve-2026-0802-axis-axis-os-command-injection-in-acap-configuration-file)
- [Axis AXIS OS privilege escalation in ACAP installation](https://junglewise.ai/threats/cve-2026-0541-axis-axis-os-privilege-escalation-in-acap-installation)
- [ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege…](https://junglewise.ai/threats/cve-2025-6298-acap-applications-can-gain-elevated-privileges-due-to-improper)
- [A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP…](https://junglewise.ai/threats/cve-2025-5452-a-malicious-acap-application-can-gain-access-to-admin-level)