AXIS Camera Station Flaw CVE-2026-13312 With CVSS 9.9 Could Let Attackers Compromise a System
Do Son 
TL;DR
Axis Communications disclosed 15 vulnerabilities on November 10, 2026, across AXIS Camera Station, AXIS OS and related tools. The most severe, CVE-2026-13312, carries a CVSS score of 9.9. Axis says this AXIS Camera Station flaw “could allow an attacker to compromise a system.”
Axis patched a critical bug in its video management software, plus 14 more flaws rated Low to High. CVE-2026-13312 needs only a low-privileged account and no user interaction. Update AXIS Camera Station Pro to 6.18 and AXIS Camera Station 5 to 5.59 SR2.
- Total: 15 CVEs
- Severity: 1 Critical · 6 High · 6 Medium · 2 Low
- Actively exploited: None confirmed
- Highest severity: 9.9 (Critical · CVSSv3) — CVE-2026-13312
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-13312 | 9.9 | CWE-1287 | 6.17, 5.59 SR2 | Not exploited |
| CVE-2026-8372 | 8.8 | CWE-306 | 6.18 | Not exploited |
| CVE-2026-4762 | 8.8 | CWE-347 | 6.18 | Not exploited |
| CVE-2026-12389 | 8.4 | CWE-502 | 5.59, 6.18 | Not exploited |
| CVE-2026-63288 | 8.3 | CWE-306 | 12.11.106.1 | Not exploited |
| CVE-2026-12964 | 8 | CWE-918 | 6.18 | Not exploited |
| CVE-2026-12963 | 7.4 | CWE-732 | 6.18, 5.59 | Not exploited |
| CVE-2026-9063 | 6.7 | CWE-427 | 12.11.80, 13.0.14 | Not exploited |
Why It Matters
AXIS Camera Station is Axis’s video management software. As a result, a takeover could expose live feeds, recordings and the network around them.
Fortunately, Axis reports no attacks. In its advisory, the company says “no known exploits exist publicly as of today and Axis is not aware that this has been exploited.” Ryan Vinton found the critical bug through the AXIS Camera Station Pro bug bounty program.
How the Attack Works
The critical flaw
CVE-2026-13312 stems from improper validation of input type (CWE-1287). It works over the network and changes scope, so damage can spread past the app. However, Axis “will not provide more detailed information about the vulnerability.”
Other High-severity bugs
- CVE-2026-8372 (CVSS 8.8): missing authentication that “could allow an attacker to gain unauthorized access” to Camera Station Pro.
- CVE-2026-4762 (CVSS 8.8): a non-admin user can escalate privileges on the server.
- CVE-2026-12389 (CVSS 8.4): unsafe deserialization lets a high-privileged user run code remotely.
- CVE-2026-63288 (CVSS 8.3): a WebSocket request bypasses authentication on AXIS A1210, A1601, A1610, A1710 and A1810 door controllers.
- CVE-2026-12964 and CVE-2026-12963: viewer accounts can gain admin rights or reach NAS storage.
Meanwhile, the AXIS OS bugs mostly require an admin account. They include command injection, SIP API flaws and a denial of service in the overlay API.
Affected Versions
- AXIS Camera Station Pro 6.0 to 6.17, and AXIS Camera Station 5 before 5.59 SR2
- AXIS OS 6.x through 13.x, depending on the flaw
- Secure Entry door controllers before 12.11.106.1
- Signed Video Framework before 2.3.7 and Axis File Player before 3.1.10.0
Patch and Mitigation
Install AXIS Camera Station Pro 6.18 or later, since 6.17 fixes only the critical bug. Next, update AXIS OS devices to the fixed build for your track. Finally, limit viewer accounts and keep AXIS Camera Station servers off the public internet.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
