Axis OS
57 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Axis OS, a product in the ics ot iot space. Use it to gauge the current risk picture and drill into individual advisories.
Axis OS CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 2 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 5 |
| 2025-04 | 2 |
| 2025-05 | 0 |
| 2025-06 | 3 |
| 2025-07 | 0 |
| 2025-08 | 2 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 11 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 4 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 5 |
| 2026-09 | 0 |
Severity
How the 57 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical2
- High12
- Medium40
- Low3
Latest CVEs
The 15 most recently published vulnerabilities affecting Axis OS.
- CVE-2026-4757A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an ad...7.2
- CVE-2026-6505The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device...5.1
- CVE-2026-5304An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the insta...5.7
- CVE-2026-5303The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device...5.7
- CVE-2026-6181The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account.5.9
- CVE-2026-1185A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited i...5.4
- CVE-2026-0804An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the A...6.7
- CVE-2026-0802An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis...6.0
- CVE-2026-0541ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploite...6.7
- CVE-2025-11142The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or ...7.1
- CVE-2025-9055The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after authenticating wi...6.4
- CVE-2025-8998It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after authenticating with an...3.1
- CVE-2025-9524The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewe...4.3
- CVE-2025-8108An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is ...6.7
- CVE-2025-6779An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is...6.7
Product grouping is registry-driven, with AI assist and human review. How it works