AXIS OS SECURE ENTRY · CVE-2026-63288 · Other
FIX → 12.11.106.1 ✓ verified
A WebSocket request sent to one API endpoint gives access to a different API endpoint without the intended authentication check. An attacker can reach functions they should not be able to call.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Axis devices running AXIS OS on the Secure Entry firmware track (access-control controllers such as A1610 and A1601 are listed with fixes). Axis rates it 8.3 with an adjacent-network vector (no login needed, attacker on the same network). Axis Powered by Genetec devices are also listed as fixed in 12.11.106.1. Devices on other AXIS OS tracks are not listed for this CVE.
Who cares access-control, api, axis, axis-os, iot, secure-entry, websocket
12.11.106.1 on the Secure Entry track should be treated as exposedUpgrade to 12.11.106.1
12.11.106.1 or later (Axis registry)A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.
This page as .md · .json · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
12.11.119.4 (2026-09-29) lists this CVE as addressed