CVE-2026-5304
published 2026-08-11CVE-2026-5304: An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis…
PriorityP433medium5.7CVSS 3.1
AVNACHPRHUIRSUCHIHAN
EPSS
0.31%
23.0th percentile
An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| axis_communications_ab | axis_os | — | — |
| axis_communications_ab | axis_os | >= 12.0.0 < 12.11.12 | 12.11.12 |
CVSS provenance
nvdv3.15.7MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Axis: Axis: Privilege escalation via malicious ACAP application installation
vendor_redhat·2026-08-11·CVSS 5.7
CVE-2026-5304 [MEDIUM] CWE-266 Axis: Axis: Privilege escalation via malicious ACAP application installation
Axis: Axis: Privilege escalation via malicious ACAP application installation
A flaw was found in Axis devices. An attacker could exploit a lack of input validation in an ACAP (AXIS Camera Application Platform) configuration file to achieve privilege escalation. This vulnerability requires the Axis device to be configured to allow unsigned ACAP applications, and an attacker must convince a victim to install a malicious ACAP application.
Package: axis (Red Hat Enterprise Linux 6) - Out of support scope
GHSA
An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation.
ghsa_unreviewed·2026-08-11
CVE-2026-5304 [MEDIUM] CWE-1287 An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation.
An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
No detection rules found.
No public exploits indexed.
2026-08-11
Published