CVE-2026-4757
published 2026-08-11CVE-2026-4757: A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be…
PriorityP349high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.57%
46.4th percentile
A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| axis_communications_ab | axis_os | — | — |
| axis_communications_ab | axis_os | >= 12.0.0 < 12.11.44 | 12.11.44 |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation.
ghsa_unreviewed·2026-08-11
CVE-2026-4757 [HIGH] CWE-732 A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation.
A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account.
Red Hat
Axis: Axis: Code execution and privilege escalation via VAPIX API improper input validation
vendor_redhat·2026-08-11·CVSS 7.2
CVE-2026-4757 [HIGH] CWE-94 Axis: Axis: Code execution and privilege escalation via VAPIX API improper input validation
Axis: Axis: Code execution and privilege escalation via VAPIX API improper input validation
A flaw was found in Axis. An attacker with an administrator-privileged service account could exploit improper input validation in a VAPIX API parameter. This could allow for arbitrary code execution and potentially lead to privilege escalation, granting the attacker higher system privileges.
Package: axis (Red Hat Enterprise Linux 6) - Affected
No detection rules found.
No public exploits indexed.
2026-08-11
Published