Axis discloses 15 flaws in camera and security products

Axis Communications has disclosed a batch of 15 vulnerabilities across AXIS Camera Station, AXIS OS and related tools, with CVE-2026-13312 identified as the most severe. The flaw, CVSS 9.9, stems from improper input type validation (CWE-1287) and can be triggered over the network to broaden its impact beyond the application itself. Axis notes that the vulnerability “could allow an attacker to compromise a system.” The firm reports no confirmed exploitation to date. Ryan Vinton is credited with discovering the critical bug through the AXIS Camera Station Pro bug bounty programme.

Affected products include AXIS Camera Station Pro 6.0–6.17, AXIS Camera Station 5 prior to 5.59 SR2, AXIS OS 6.x–13.x (depending on the flaw), Secure Entry door controllers prior to 12.11.106.1, and the Signed Video Framework prior to 2.3.7 with Axis File Player before 3.1.10.0. Axis advises applying updates promptly: AXIS Camera Station Pro should be updated to 6.18 or later, and AXIS OS devices must be updated to the fixed build for the corresponding track. The company also recommends restricting viewer accounts and keeping AXIS Camera Station servers off the public internet.

In addition to the CVE-2026-13312 entry, the advisory lists several high-severity issues, including CVE-2026-8372 (unauthorized access to Camera Station Pro), CVE-2026-4762 (non-admin privilege escalation on the server) and CVE-2026-12389 (unsafe deserialization enabling remote code execution by a high-privileged user). Other flaws affect WebSocket authentication bypasses on certain door controllers and viewer-to-admin privilege escalations. Axis describes these vulnerabilities as not exploited publicly to date, and fixes vary by product track.