---
id: "CVE-2026-12389"
page: "https://infrastack.ai/live/CVE-2026-12389"
kind: "vulnerability"
aliases: ["CVE-2026-12389"]
title: "AXIS Camera Station: privileged user can achieve remote code execution (fix version not yet published)"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "AXIS Camera Station", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}]
ecosystems: []
tags: ["axis", "axis-camera-station", "other", "rce", "windows"]
not_affected_if: ["auth-required"]
published_at: "2026-11-10T06:17:08+00:00"
first_seen_at: "2026-11-10T06:20:23+00:00"
updated_at: "2026-11-10T06:24:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12389", "first_seen_at": "2026-11-10T06:20:23+00:00"}, {"source": "analyst", "url": "https://help.axis.com/en-us/security-advisories", "first_seen_at": "2026-11-10T06:24:46+00:00", "cites": ["https://help.axis.com/en-us/security-advisories"]}]
exploit_sources: []
---

# AXIS Camera Station: privileged user can achieve remote code execution (fix version not yet published)

Link for people: https://infrastack.ai/live/CVE-2026-12389 (this .md is for agents)

Axis (the CNA) lists CVE-2026-12389 (CVSS 8.4, High) under AXIS Camera Station in its security advisory registry. The released version is 'TBA' and the entry says more detail follows on 10 November 2026. NVD describes a high-privileged authenticated user performing a remote code execution attack. Vector is adjacent network, high privileges required. No exploitation or PoC seen.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AXIS Camera Station affected unknown fixed no fixed version listed

## How to check

Check the installed AXIS Camera Station version (Help > About in the client). Compare it with the Axis advisory for CVE-2026-12389 once Axis publishes the affected range; the registry says 'TBA' for now. Also review who holds administrator-level accounts on the server.

## Timeline

- 2026-11-10T06:20:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12389
- 2026-11-10T06:24:46+00:00 analyst https://help.axis.com/en-us/security-advisories — Axis registry (help.axis.com security-advisories) lists CVE-2026-12389 under AXIS Camera Station, 8.4 High, release TBA, details due 10 Nov 2026. No detailed advisory yet; revisit for affected/fixed versions. X and Exa search not used for discussion. Nothing marked verified.

## Documents

- [advisory] Axis security advisories registry (Nov 2026) https://help.axis.com/en-us/security-advisories

## From the sources

A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_