{"id":"CVE-2026-14543","kind":"vulnerability","aliases":["CVE-2026-14543"],"related":[],"title":"Axis VAPIX Edge storage API lets admins escape filesystem isolation","description":"The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.","summary":"The VAPIX Edge storage API in Axis network devices can be abused to bypass filesystem isolation and reach protected system resources. Exploitation requires authenticating first with an admin-privileged service account.","severity":"low","cvss":3.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["axis","edge-devices","infrastructure","iot","vapix"],"not_affected_if":["no-admin-service-accounts","no-axis-devices"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T06:17:09+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","triaged_at":"2026-11-10T06:22:21+00:00","updated_at":"2026-11-10T06:22:21+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T06:22:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Axis VAPIX Edge storage API lets admins escape filesystem isolation","impact":"medium","summary":"The VAPIX Edge storage API in Axis network devices can be abused to bypass filesystem isolation and reach protected system resources. Exploitation requires authenticating first with an admin-privileged service account.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["axis","vapix","edge-devices","iot"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains unauthorized access to protected device system resources","analyst_note":"Find the Axis advisory listing affected and fixed firmware versions for CVE-2026-14543 and the VAPIX Edge storage API details.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-axis-devices","no-admin-service-accounts"],"who_is_affected":"Organizations running Axis devices that expose the VAPIX Edge storage API and use admin-privileged service accounts. Sources do not name affected firmware versions. Teams without Axis devices can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000679,"input_tokens":4533,"output_tokens":452,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-14543':13A,16A '-2026':12A,15A 'abus':35B 'access':73C 'account':55B,92C 'admin':7A,52B,89C 'admin-privileg':51B,88C 'api':5A,28B,60C 'authent':47B,85C 'axi':1A,17B,30B 'bypass':37B 'circumv':68C 'cve':11A,14A 'devic':20B,32B 'edg':3A,19B,26B,58C 'edge-devic':18B 'enabl':61C 'escal':63C 'escap':8A 'exploit':45B,83C 'filesystem':9A,38B,69C 'first':48B 'flaw':79C 'grant':71C 'infrastructur':21B 'iot':22B 'isol':10A,39B,70C 'let':6A 'network':31B 'privileg':53B,66C,90C 'protect':42B,75C 'reach':41B 'requir':46B 'resourc':44B,77C 'servic':54B,91C 'storag':4A,27B,59C 'system':43B,76C 'unauthor':72C 'user':65C 'vapix':2A,23B,25B,57C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Axis devices that expose the VAPIX Edge storage API and use admin-privileged service accounts. Sources do not name affected firmware versions. Teams without Axis devices can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["axis","edgedevices","infrastructure","iot","low","vapix"],"campaign_type":null,"search_a":"'-14543':13A,16A '-2026':12A,15A 'admin':7A 'api':5A 'axi':1A 'cve':11A,14A 'edg':3A 'escap':8A 'filesystem':9A 'isol':10A 'let':6A 'storag':4A 'vapix':2A","search_b":"'abus':35B 'account':55B 'admin':52B 'admin-privileg':51B 'api':28B 'authent':47B 'axi':17B,30B 'bypass':37B 'devic':20B,32B 'edg':19B,26B 'edge-devic':18B 'exploit':45B 'filesystem':38B 'first':48B 'infrastructur':21B 'iot':22B 'isol':39B 'network':31B 'privileg':53B 'protect':42B 'reach':41B 'requir':46B 'resourc':44B 'servic':54B 'storag':27B 'system':43B 'vapix':23B,25B","search_c":"'access':73C 'account':92C 'admin':89C 'admin-privileg':88C 'api':60C 'authent':85C 'circumv':68C 'edg':58C 'enabl':61C 'escal':63C 'exploit':83C 'filesystem':69C 'flaw':79C 'grant':71C 'isol':70C 'privileg':66C,90C 'protect':75C 'resourc':77C 'servic':91C 'storag':59C 'system':76C 'unauthor':72C 'user':65C 'vapix':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T06:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"product-security@axis.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14543","severity":null,"published_at":"2026-11-10T06:17:09+00:00","modified_at":"2026-11-10T06:17:09+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","fetched_at":"2026-11-10T06:20:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}