---
id: "CVE-2026-12963"
page: "https://infrastack.ai/live/CVE-2026-12963"
kind: "vulnerability"
aliases: ["CVE-2026-12963"]
title: "AXIS Camera Station: viewer account can reach network attached storage devices (fix not yet released)"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AXIS Camera Station", "fixed": [], "affected": "unknown, Axis has not published versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["axis", "axis-camera-station", "infrastructure", "network-attached-storage", "self-hosted", "windows"]
not_affected_if: []
published_at: "2026-11-10T06:17:08+00:00"
first_seen_at: "2026-11-10T06:20:23+00:00"
updated_at: "2026-11-10T06:24:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12963", "first_seen_at": "2026-11-10T06:20:23+00:00"}, {"source": "analyst", "url": "https://help.axis.com/en-us/security-advisories", "first_seen_at": "2026-11-10T06:24:50+00:00", "cites": ["https://help.axis.com/en-us/security-advisories"]}]
exploit_sources: []
---

# AXIS Camera Station: viewer account can reach network attached storage devices (fix not yet released)

Link for people: https://infrastack.ai/live/CVE-2026-12963 (this .md is for agents)

A flaw lets a low-privilege viewer account gain access to network attached storage devices reachable from the server. An attacker with a viewer login could read or change data on those storage devices.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AXIS Camera Station affected unknown, Axis has not published versions fixed no fixed version listed

## How to check

Check whether you run AXIS Camera Station (Pro or 5) and which version (Help > About in the client). Axis has not published affected versions yet; review the Axis security advisories page for the full advisory.

## Fix

No patched version published yet: Axis lists the released version as TBA. Check the Axis advisory registry for the fixed AXIS Camera Station Pro release.

## Timeline

- 2026-11-10T06:20:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12963
- 2026-11-10T06:24:50+00:00 analyst https://help.axis.com/en-us/security-advisories — Axis registry (help.axis.com) lists CVE-2026-12963 7.4 High under AXIS Camera Station, released version TBA, details to follow on 10 Nov 2026; CVSS by Axis. No per-CVE advisory PDF found yet. Revisit when Axis publishes it. Whether the viewer account is a Camera Station role is inferred from the NVD summary, not confirmed.

## Documents

- [advisory] Axis security advisories registry (Nov 2026) https://help.axis.com/en-us/security-advisories

## From the sources

A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_