Quick answers
- Is CVE-2026-6505 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-6505 being exploited in the wild.
- How severe is CVE-2026-6505?
- Medium severity, with a CVSS score of 5.1, published 11 August 2026.
- Which products and versions are affected?
- Axis ACAP framework.
- Is there a fix for CVE-2026-6505?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-6505 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-6505?
- Check whether you run Axis ACAP framework. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition in the ACAP framework's privilege handling during application installation. The flaw exists in the window between security validation and execution of an ACAP application, allowing an attacker to modify application behavior to gain elevated privileges. Exploitation requires two conditions: the target Axis device must be configured to permit unsigned ACAP application installation, and an attacker must convince a user to install a malicious application. An attacker with code execution through an ACAP application can leverage the TOCTOU condition to escalate privileges beyond the application's intended sandbox. Patches are expected from Axis for affected device models.
Affected products
- Axis ACAP framework
Timeline
- 2026-08-11: disclosed