PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-0804 Axis Communications AB CVE debrief

A path traversal vulnerability in Axis OS ACAP configuration file handling could allow privilege escalation when unsigned ACAP application installation is enabled. The vulnerability requires both administrative misconfiguration (allowing unsigned apps) and social engineering to install a malicious application. Axis has released patched firmware in version 12.10.4.

Vendor
Axis Communications AB
Product
AXIS OS
CVSS
MEDIUM 6.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-19
Advisory published
2026-05-12
Advisory updated
2026-05-19

Who should care

Axis network camera and device administrators, physical security teams, IoT security practitioners, and organizations deploying Axis surveillance infrastructure

Technical summary

CVE-2026-0804 is a path traversal vulnerability (CWE-35) in Axis OS affecting versions 12.0.0 through 12.10.3. The vulnerability exists in ACAP (Axis Camera Application Platform) configuration file handling, which lacks sufficient input validation. Exploitation requires the device to be configured to allow unsigned ACAP applications and requires an attacker to convince a victim to install a malicious ACAP application. Successful exploitation could lead to privilege escalation with local attack vector, low attack complexity, and high privileges required (CVSS 3.1: 6.7 MEDIUM). The vulnerability was patched in Axis OS 12.10.4.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Axis OS to version 12.10.4 or later
  • Disable unsigned ACAP application installation in device configuration
  • Restrict ACAP application installation to trusted administrators only
  • Verify ACAP application signatures before installation
  • Review installed ACAP applications for unauthorized or suspicious entries

Evidence notes

Vendor advisory confirms CWE-35 (Path Traversal) and CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Affected versions: Axis OS 12.0.0 through 12.10.3. Fixed in 12.10.4.

Official resources

2026-05-12