CVE-2026-14543
Received Received - Intake

VAPIX Edge Storage API Privilege Escalation

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: Axis Communications AB

Description
The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-14543
EUVD
EUVD-2026-120772

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Axis Communications AB AXIS OS From 13.0.0 (inc) to 13.0.42 (exc)
Axis Communications AB AXIS OS From 12.0.0 (inc) to 12.11.84 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-1287 The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the VAPIX Edge storage API of Axis Communications products. It allows privilege escalation by bypassing filesystem isolation, which means an attacker with admin privileges can access protected system resources they shouldn't be able to reach.

Detection Guidance

Detection requires checking Axis device software versions against patched releases. Verify if your device runs Active Track 13.0.42 or LTS 2026 12.11.84. Use Axis device management tools or CLI commands like 'show version' to confirm software versions.

Impact Analysis

If exploited, this flaw could let an authenticated admin-privileged user gain unauthorized access to sensitive system resources. However, exploitation requires admin access, reducing the risk for most users. No known public exploits exist as of the advisory date.

Compliance Impact

This vulnerability allows unauthorized access to protected system resources by bypassing filesystem isolation, which could lead to data breaches or unauthorized data exposure. Such breaches may violate compliance requirements under GDPR or HIPAA, depending on the data involved.

Mitigation Strategies

Immediately update affected Axis devices to Active Track 13.0.42 or LTS 2026 12.11.84. Ensure admin-privileged accounts follow least-privilege principles. Monitor for unauthorized access attempts and restrict service account permissions where possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14543. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...