CVE-2026-63286
Received Received - Intake

Offline Attack Vulnerability in AXIS Camera Station Pro Backups

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: Axis Communications AB

Description
Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the credentials stored in AXIS Camera Station Pro.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-63286
EUVD
EUVD-2026-111816

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-326 The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves database backups created by AXIS Camera Station Pro versions prior to 6.20 being susceptible to offline attacks due to weak encryption. The flaw, tracked as CWE-326, allows attackers to potentially access sensitive data from these backups even if the system is updated.

Detection Guidance

To detect this vulnerability, check for AXIS Camera Station Pro versions prior to 6.20 or AXIS Camera Station 5. Verify if database backups exist and were created before applying the patch. No specific commands are provided in the context, but you can inspect installed software versions and backup files manually.

Impact Analysis

Attackers could exploit this to gain unauthorized access to sensitive data stored in vulnerable backups. This may lead to data breaches, unauthorized system access, or credential theft if stored credentials are compromised.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations requiring data protection. Unauthorized access to backups may result in data breaches, triggering legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately update to AXIS Camera Station Pro 6.20 or later. Delete all database backups created before the update. Change credentials stored in AXIS Camera Station Pro. Follow system hardening guides for secure backup storage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63286. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart