CVE-2026-5304
Received Received - Intake

Privilege Escalation in Axis ACAP Configuration

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Axis Communications AB

Description
An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-5304
EUVD
EUVD-2026-55965

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
axis axis_os From 12.0.0 (inc) to 12.11.11 (inc)
axis axis_os 12.11.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1287 The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-5304 is a vulnerability in AXIS OS versions 12.0.0 through 12.11.11 where an ACAP configuration file lacks input validation. This could allow privilege escalation if an attacker tricks a user into installing a malicious, unsigned ACAP application on a device configured to permit such installations.

Detection Guidance

To detect this vulnerability, check if your Axis device is running AXIS OS versions 12.0.0 through 12.11.11. Verify if the device allows installation of unsigned ACAP applications. Use Axis device management tools or CLI commands to inspect installed ACAP applications and their configuration files for improper input validation.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain elevated privileges on an affected Axis device. This might lead to unauthorized access, control, or manipulation of the device and its connected systems.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA if exploited, as it may lead to unauthorized privilege escalation on Axis devices. Unauthorized access could result in data breaches or improper handling of sensitive information, which are key concerns under these regulations.

Mitigation Strategies

Immediately update your Axis device to AXIS OS version 12.11.12 or later to patch the vulnerability. Disable the installation of unsigned ACAP applications if not required. Monitor for any suspicious ACAP applications and restrict installation permissions to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5304. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart