CVE-2026-9063
Received Received - Intake

Privilege Escalation in AXIS Camera Station

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: Axis Communications AB

Description
A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. This flaw can only be exploited after authenticating with an admin-privileged service account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-9063
EUVD
EUVD-2026-120769

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Axis Communications AB AXIS OS From 12.0.0 (inc) to 12.11.80 (exc)
Axis Communications AB AXIS OS From 13.0.0 (inc) to 13.0.14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-9063 is a privilege escalation vulnerability where a locally authenticated user with admin privileges can exploit an insecure configuration to execute unauthorized code. The flaw is classified under CWE-427 (Uncontrolled Search Path Element) and requires admin access to trigger.

Detection Guidance

Detection requires checking AXIS OS versions against vulnerable releases. Verify installed AXIS OS version via admin interface or CLI commands like 'show version' or 'cat /etc/os-release'. Compare against patched versions (13.0.14 for Active Track, 12.11.80 for LTS 2026).

Impact Analysis

If exploited, this vulnerability allows an attacker to escalate privileges and execute arbitrary code on the affected system. This could lead to full system compromise, data theft, or unauthorized system modifications. However, exploitation requires admin privileges and local access.

Mitigation Strategies

Immediately update AXIS OS to patched versions (13.0.14 or 12.11.80). Ensure only trusted admin accounts have access. Monitor for unauthorized code execution attempts. Contact Axis Technical Support for assistance if needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9063. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...