# Axis vulnerabilities Source: https://junglewise.ai/threats/vendors/axis Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/axis.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 23 vulnerabilities in Axis: 11 in the last 7 days and 12 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-9063, was published on 10 November 2026. 1 vulnerability in the last four weeks, up from none in the four before. 2 technologies have a page of their own. ## Counts - Last 7 days: 11 - Last 30 days: 12 - Last 90 days: 12 - All time: 23 (0 critical, 0 exploited in the wild) ## About Axis A manufacturer of network hardware, including cameras, access control, and audio devices. ## Latest Axis vulnerabilities - [CVE-2026-9063: Axis product privilege escalation via insecure configuration](https://junglewise.ai/threats/cve-2026-9063-a-locally-authenticated-user-can-achieve-privilege-escalation-via) (medium, CVSS 6.7, published 10 Nov 2026) - [CVE-2026-8372: Axis product unauthorized access vulnerability](https://junglewise.ai/threats/cve-2026-8372-a-vulnerability-that-could-allow-an-attacker-to-gain-unauthorized) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-63288: Axis API authentication bypass via WebSocket request](https://junglewise.ai/threats/cve-2026-63288-a-websocket-request-sent-to-a-specific-api-endpoint-allows) (high, CVSS 8.3, published 10 Nov 2026) - [CVE-2026-63287: Axis Camera Station permission bypass in audit logs](https://junglewise.ai/threats/cve-2026-63287-it-was-possible-for-an-authenticated-non-admin-user-to-modify) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-4762: Axis privilege escalation vulnerability](https://junglewise.ai/threats/cve-2026-4762-a-vulnerability-to-perform-a-privilege-escalation-attack-on-the) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-14918: Axis Signed Video Framework out-of-bounds read](https://junglewise.ai/threats/cve-2026-14918-the-signed-video-framework-contained-a-out-of-bounds-read-issue) (medium, CVSS 5.3, published 10 Nov 2026) - [CVE-2026-14542: Axis VAPIX SIP API privilege escalation](https://junglewise.ai/threats/cve-2026-14542-the-vapix-sip-configuration-api-lacked-sufficient-input) (medium, CVSS 6.7, published 10 Nov 2026) - [CVE-2026-13409: Axis VAPIX API denial of service in dynamicoverlay.cgi](https://junglewise.ai/threats/cve-2026-13409-the-vapix-api-dynamicoverlay-cgi-which-results-in-a-denial-of) (medium, CVSS 4.3, published 10 Nov 2026) - [CVE-2026-12964: Axis Camera privilege escalation in viewer account](https://junglewise.ai/threats/cve-2026-12964-a-vulnerability-allowing-for-privileged-escalation-of-the-viewer) (high, CVSS 8, published 10 Nov 2026) - [CVE-2026-12963: Axis network attached storage authorization bypass](https://junglewise.ai/threats/cve-2026-12963-a-vulnerability-that-could-allow-a-viewer-account-to-gain) (high, CVSS 7.4, published 10 Nov 2026) - [CVE-2026-12389: Axis product authenticated remote code execution](https://junglewise.ai/threats/cve-2026-12389-a-vulnerability-that-could-lead-to-a-high-privileged) (high, CVSS 8.4, published 10 Nov 2026) - [CVE-2026-63286: Axis Camera Station Pro database backup offline attack vulnerability](https://junglewise.ai/threats/cve-2026-63286-database-backups-are-vulnerable-to-offline-attacks-backups) (high, CVSS 7.1, published 28 Oct 2026) - [CVE-2026-8158: Axis Signed Video Framework buffer overflow](https://junglewise.ai/threats/cve-2026-8158-axis-signed-video-framework-buffer-overflow) (medium, CVSS 5.3, published 11 Aug 2026) - [CVE-2026-6505: Axis ACAP framework TOCTOU race condition](https://junglewise.ai/threats/cve-2026-6505-axis-acap-framework-toctou-race-condition) (medium, CVSS 5.1, published 11 Aug 2026) - [CVE-2026-5303: Axis ACAP framework privilege escalation via TOCTOU race condition](https://junglewise.ai/threats/cve-2026-5303-axis-acap-framework-privilege-escalation-via-toctou-race-condition) (medium, CVSS 5.7, published 11 Aug 2026) - [CVE-2026-4757: Axis VAPIX API improper input validation in parameter handling](https://junglewise.ai/threats/cve-2026-4757-axis-vapix-api-improper-input-validation-in-parameter-handling) (high, CVSS 7.2, published 11 Aug 2026) - [CVE-2026-1185: Axis AXIS OS privilege escalation via configuration file](https://junglewise.ai/threats/cve-2026-1185-axis-axis-os-privilege-escalation-via-configuration-file) (medium, CVSS 5.4, published 12 May 2026) - [CVE-2026-0804: Axis AXIS OS path traversal in ACAP configuration](https://junglewise.ai/threats/cve-2026-0804-axis-axis-os-path-traversal-in-acap-configuration) (medium, CVSS 6.7, published 12 May 2026) - [CVE-2026-0802: Axis AXIS OS command injection in ACAP configuration file](https://junglewise.ai/threats/cve-2026-0802-axis-axis-os-command-injection-in-acap-configuration-file) (medium, CVSS 6, published 12 May 2026) - [CVE-2026-0541: Axis AXIS OS privilege escalation in ACAP installation](https://junglewise.ai/threats/cve-2026-0541-axis-axis-os-privilege-escalation-in-acap-installation) (medium, CVSS 6.7, published 12 May 2026) - [CVE-2025-6298: ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege…](https://junglewise.ai/threats/cve-2025-6298-acap-applications-can-gain-elevated-privileges-due-to-improper) (medium, CVSS 6.7, published 11 Nov 2025) - [CVE-2025-5452: A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP…](https://junglewise.ai/threats/cve-2025-5452-a-malicious-acap-application-can-gain-access-to-admin-level) (medium, CVSS 6.6, published 11 Nov 2025) - [CVE-2025-4645: An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This…](https://junglewise.ai/threats/cve-2025-4645-an-acap-configuration-file-lacked-sufficient-input-validation) (medium, CVSS 6.7, published 11 Nov 2025) ## Most severe Axis vulnerabilities - [CVE-2026-8372: Axis product unauthorized access vulnerability](https://junglewise.ai/threats/cve-2026-8372-a-vulnerability-that-could-allow-an-attacker-to-gain-unauthorized) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-4762: Axis privilege escalation vulnerability](https://junglewise.ai/threats/cve-2026-4762-a-vulnerability-to-perform-a-privilege-escalation-attack-on-the) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-12389: Axis product authenticated remote code execution](https://junglewise.ai/threats/cve-2026-12389-a-vulnerability-that-could-lead-to-a-high-privileged) (high, CVSS 8.4, published 10 Nov 2026) - [CVE-2026-63288: Axis API authentication bypass via WebSocket request](https://junglewise.ai/threats/cve-2026-63288-a-websocket-request-sent-to-a-specific-api-endpoint-allows) (high, CVSS 8.3, published 10 Nov 2026) - [CVE-2026-12964: Axis Camera privilege escalation in viewer account](https://junglewise.ai/threats/cve-2026-12964-a-vulnerability-allowing-for-privileged-escalation-of-the-viewer) (high, CVSS 8, published 10 Nov 2026) - [CVE-2026-12963: Axis network attached storage authorization bypass](https://junglewise.ai/threats/cve-2026-12963-a-vulnerability-that-could-allow-a-viewer-account-to-gain) (high, CVSS 7.4, published 10 Nov 2026) - [CVE-2026-4757: Axis VAPIX API improper input validation in parameter handling](https://junglewise.ai/threats/cve-2026-4757-axis-vapix-api-improper-input-validation-in-parameter-handling) (high, CVSS 7.2, published 11 Aug 2026) - [CVE-2026-63286: Axis Camera Station Pro database backup offline attack vulnerability](https://junglewise.ai/threats/cve-2026-63286-database-backups-are-vulnerable-to-offline-attacks-backups) (high, CVSS 7.1, published 28 Oct 2026) - [CVE-2025-4645: An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This…](https://junglewise.ai/threats/cve-2025-4645-an-acap-configuration-file-lacked-sufficient-input-validation) (medium, CVSS 6.7, published 11 Nov 2025) - [CVE-2025-6298: ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege…](https://junglewise.ai/threats/cve-2025-6298-acap-applications-can-gain-elevated-privileges-due-to-improper) (medium, CVSS 6.7, published 11 Nov 2025) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 11 | 0 | 0 | ## Axis technologies - [Axis Os](https://junglewise.ai/threats/technologies/axis-os): 7 vulnerabilities - [Axis ](https://junglewise.ai/threats/technologies/axis-unknown): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Axis vulnerabilities", https://junglewise.ai/threats/vendors/axis, 12 November 2026.