AXIS CAMERA STATION · CVE-2026-12389 · Other
NO FIX YET
Axis (the CNA) lists CVE-2026-12389 (CVSS 8.4, High) under AXIS Camera Station in its security advisory registry. The released version is 'TBA' and the entry says more detail follows on 10 November 2026. NVD describes a high-privileged authenticated user performing a remote code execution attack. Vector is adjacent network, high privileges required. No exploitation or PoC seen.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running AXIS Camera Station (the video management server and clients) are the ones Axis lists for this CVE. An attacker needs an account with high privileges and access from an adjacent network. Which Camera Station editions and versions are affected has not been published yet. Anyone not running Camera Station can skip it.
Not affected if auth-required
Who cares axis, axis-camera-station, rce, windows
TBA for nowNo fix yet, per the sources.
A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack.
This page as .md · .json · CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.