# CVE-2026-121024: AxxonSoft AxxonNet authorization bypass in Health Monitoring service

Source: https://junglewise.ai/threats/cve-2026-121024-incorrect-authorization-cwe-863-in-the-health-monitoring-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121024 · Severity: medium · CVSS 5.4 · Published 2026-11-03

AxxonNet is a video management and physical security information management platform running on Linux servers. A flaw in the Health Monitoring service allows remote attackers who possess a read-only shared report token to bypass authorization controls and create, modify, or delete monitoring alerts. This could enable unauthorized changes to system alerts and alerts without requiring higher privileges.

Vendors: [AxxonSoft](https://junglewise.ai/threats/vendors/axxonsoft).

## Quick answers

**Is CVE-2026-121024 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121024 being exploited in the wild.

**How severe is CVE-2026-121024?** Medium severity, with a CVSS score of 5.4, published 3 November 2026.

**Which products and versions are affected?** AxxonSoft AxxonNet before 3.28.0.

**Is there a fix for CVE-2026-121024?** Yes: fixed in 3.28.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121024 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-121024?** Check whether you run AxxonSoft AxxonNet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.28.0

## Technical details

A CWE-863 (Incorrect Authorization) vulnerability exists in the Health Monitoring service API, where authorization checks fail to properly validate token scope. An attacker with a read-only shared report token can invoke monitoring API endpoints intended for alert management without proper privilege validation. The vulnerability requires network access and possession of a legitimate (but limited-scope) token, and impacts the integrity of alert configuration.

## Affected products

- AxxonSoft AxxonNet before 3.28.0

## Timeline

- 2026-11-03: disclosed

## References

- [https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories](https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories)

## Related threats

- [AxxonSoft AxxonNet sensitive information insertion into log file](https://junglewise.ai/threats/cve-2026-121023-insertion-of-sensitive-information-into-log-file-cwe-532-in-the)