# CVE-2026-121022: AxxonSoft Axxon One default password in web client

Source: https://junglewise.ai/threats/cve-2026-121022-use-of-default-password-cwe-1393-in-the-web-client-in-axxonsoft  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121022 · Severity: high · CVSS 8.1 · Published 2026-11-03

Axxon One is a video management and physical security management platform used to monitor and protect buildings and critical infrastructure. On newly installed systems, the web client allows remote attackers to log in as administrator using built-in default credentials because the system does not force a mandatory password change on first login. An attacker gaining administrator access could modify security settings, disable monitoring, access video footage, or launch further attacks on the network.

Technologies: [AxxonSoft Axxon One](https://junglewise.ai/threats/technologies/axxon-one). Vendors: [AxxonSoft](https://junglewise.ai/threats/vendors/axxonsoft).

## Quick answers

**Is CVE-2026-121022 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121022 being exploited in the wild.

**How severe is CVE-2026-121022?** High severity, with a CVSS score of 8.1, published 3 November 2026.

**Which products and versions are affected?** AxxonSoft Axxon One before 3.0.0.

**Is there a fix for CVE-2026-121022?** Yes: fixed in 3.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121022 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-121022?** Check whether you run AxxonSoft Axxon One at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.0

## Technical details

The vulnerability exists in the web client component of Axxon One, which accepts default administrator credentials on initial deployment without enforcing password change. An unauthenticated remote attacker can directly access the web interface and authenticate using well-known default credentials, gaining full administrator privileges. This affects versions before 3.0.0 on both Windows and Linux deployments.

## Affected products

- AxxonSoft Axxon One before 3.0.0

## Timeline

- 2026-11-03: disclosed

## References

- [https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories](https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories)

## Related threats

- [AxxonSoft Axxon One plaintext password storage in configuration](https://junglewise.ai/threats/cve-2026-121021-plaintext-storage-of-a-password-cwe-256-in-the-securitymanager)
- [AxxonSoft Axxon One information disclosure in security configuration API](https://junglewise.ai/threats/cve-2026-121020-exposure-of-sensitive-information-to-an-unauthorized-actor-cwe)