--- title: "Axis Communications vulnerabilities: CVEs, CISA KEV and security advisories" url: https://radicalnotion.ai/vendor/axis type: vendor description: "Axis Communications has 126 published CVEs, 0 in CISA KEV and 31 with public exploits." updated: 2026-10-28 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Axis Communications vulnerabilities - **Published CVEs:** 126 - **In CISA KEV:** 0 - **With a public exploit:** 31 - **With a patch:** 76 - **Average CVSS:** 6.9 - **CVEs in the last two years:** 48 - **First CVE:** 2000-04-18 - **Latest CVE:** 2026-10-28 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 16 | | High | 46 | | Medium | 61 | | Low | 3 | | Unscored | 0 | ## Most affected products | Product | CVEs | | --- | --- | | [AXIS OS](https://radicalnotion.ai/vendor/axis/axis-os) | 57 | | [AXIS Camera Station Pro](https://radicalnotion.ai/vendor/axis/axis-camera-station-pro) | 15 | | [2100 network camera](https://radicalnotion.ai/vendor/axis/2100-network-camera) | 12 | | [camera station pro](https://radicalnotion.ai/vendor/axis/camera-station-pro) | 11 | | [axis\_os\_2022](https://radicalnotion.ai/vendor/axis/axis-os-2022) | 10 | | [a1001 firmware](https://radicalnotion.ai/vendor/axis/a1001-firmware) | 9 | | [a1001](https://radicalnotion.ai/vendor/axis/a1001) | 9 | | [m1033-w](https://radicalnotion.ai/vendor/axis/m1033-w) | 9 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-1287](https://radicalnotion.ai/cwe/cwe-1287) | Improper Validation of Specified Type of Input | 9 | | [CWE-35](https://radicalnotion.ai/cwe/cwe-35) | Path Traversal: '.../...//' | 8 | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 8 | | [CWE-78](https://radicalnotion.ai/cwe/cwe-78) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 6 | | [CWE-1286](https://radicalnotion.ai/cwe/cwe-1286) | Improper Validation of Syntactic Correctness of Input | 6 | | [CWE-732](https://radicalnotion.ai/cwe/cwe-732) | Incorrect Permission Assignment for Critical Resource | 6 | | [CWE-119](https://radicalnotion.ai/cwe/cwe-119) | Improper Restriction of Operations within the Bounds of a Memory Buffer | 4 | | [CWE-863](https://radicalnotion.ai/cwe/cwe-863) | Incorrect Authorization | 4 | ## Assigning CNAs | CNA | CVEs | | --- | --- | | [Axis](https://radicalnotion.ai/cna/axis) | 86 | | [mitre](https://radicalnotion.ai/cna/mitre) | 34 | | [certcc](https://radicalnotion.ai/cna/certcc) | 5 | | [flexera](https://radicalnotion.ai/cna/flexera) | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2021 | 4 | | 2022 | 4 | | 2023 | 17 | | 2024 | 16 | | 2025 | 32 | | 2026 | 16 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-63286 | - | high | 7.1 | 0.1% | No | 2026-10-28 | | CVE-2026-4757 | A VAPIX API parameter had improper input validation which could allow code execution and... | high | 7.2 | 0.6% | No | 2026-08-11 | | CVE-2026-6505 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could... | medium | 5.1 | 0.1% | No | 2026-08-11 | | CVE-2026-5304 | An ACAP configuration file lacks input validation, which could potentially lead to privilege... | medium | 5.7 | 0.3% | No | 2026-08-11 | | CVE-2026-5303 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could... | medium | 5.7 | 0.2% | No | 2026-08-11 | | CVE-2026-8158 | The Signed Video Framework contained a buffer overflow issue which could lead the application... | medium | 5.3 | 0.3% | No | 2026-08-11 | | CVE-2026-6181 | The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can... | medium | 5.9 | 0.4% | No | 2026-08-11 | | CVE-2026-1185 | - | high | 8.8 | 0.2% | No | 2026-05-12 | | CVE-2026-0804 | - | high | 7.3 | 0.1% | No | 2026-05-12 | | CVE-2026-0802 | - | high | 7.3 | 0.4% | No | 2026-05-12 | | CVE-2026-0541 | - | high | 7.3 | 0.1% | No | 2026-05-12 | | CVE-2025-12063 | - | medium | 5.7 | 0.2% | No | 2026-02-10 | ## Frequently asked questions ### How many CVEs does Axis Communications have? Axis Communications has 126 published CVE records since 2000, including 48 in the last two years. ### How many Axis Communications CVEs are in CISA KEV? None of Axis Communications's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Which Axis Communications products have the most CVEs? The Axis Communications products with the most published CVEs are AXIS OS, AXIS Camera Station Pro, 2100 network camera, camera station pro, axis\_os\_2022. ### What are the most common weakness types in Axis Communications CVEs? Axis Communications's CVEs most often map to these CWE weakness types: CWE-1287 (Improper Validation of Specified Type of Input), CWE-35 (Path Traversal: '.../...//'), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')). ### Are there public exploits for Axis Communications vulnerabilities? Yes — 31 of Axis Communications's CVEs have a known public exploit. ### How many critical Axis Communications vulnerabilities are there? Axis Communications has 16 critical and 46 high-severity CVEs. ### What is the average severity of Axis Communications CVEs? The average CVSS base score across Axis Communications's scored CVEs is 6.9. ## Related vendors - [Cap-go](https://radicalnotion.ai/vendor/cap-go) (127 CVEs) - [carmelo](https://radicalnotion.ai/vendor/carmelo) (127 CVEs) - [ChurchCRM](https://radicalnotion.ai/vendor/churchcrm) (127 CVEs) - [Accellion](https://radicalnotion.ai/vendor/accellion) (126 CVEs) - [Johnson Controls](https://radicalnotion.ai/vendor/johnson-controls) (126 CVEs) - [libming](https://radicalnotion.ai/vendor/libming) (126 CVEs) - [swftools](https://radicalnotion.ai/vendor/swftools) (126 CVEs) - [Philips](https://radicalnotion.ai/vendor/philips) (125 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/axis). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.