---
title: "Axis Communications AXIS OS vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/axis/axis-os
type: product
description: "Axis Communications AXIS OS has 57 published CVEs, 0 in CISA KEV and 0 with public exploits."
updated: 2026-08-11
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Axis Communications AXIS OS vulnerabilities

Vendor: [Axis Communications](https://radicalnotion.ai/vendor/axis)

- **Published CVEs:** 57
- **In CISA KEV:** 0
- **With a public exploit:** 0
- **With a patch:** 53
- **Average CVSS:** 6.7
- **First CVE:** 2021-10-05
- **Latest CVE:** 2026-08-11
- **Platforms:** a1210 (-b), a1214, a1601, a1610 (-b), a1710-b, a1810-b, a8207, a8207 mkii, a8207-ve mk ii, artpec 8, c1110-e, c1111-e, c1210-e, c1211-e, c1310-e mk ii, c1410 mk ii, c1510, c1511, c1610-ve, c1710, c1720, c6110, c8110, c8210, d1110, d201-s xpt q6075, d2110-ve, d2210-ve, d3110 mk ii, d4100-ve mk ii, d4200-ve, d6310, excam xf q1785, excam xpt q6075, f9104-b main unit, f9104-b mk ii main unit, f9111 main unit, f9111 mk ii main unit, f9111-r mk ii main unit, f9114 main unit, f9114-b main unit, f9114-b-r mk ii main unit, f9114-bt, fa51, fa51-b, fa54, i.mx6 sx, i.mx6 ull, i.mx8 qp, i.mx8m mini, i.mx8m nano ul, i7010-safety, i7010-ve, i7020, i8016-lve, i8116-e, i8307-ve, m1055-l, m1075-l, m1135, m1135-e mk ii, m1137, m1137-e mk ii, m2035-le, m2036-le, m3057-plr mk ii, m3085-v, m3086-v, m3086-v mic, m3088-v, m3125-lve, m3126-lve, m3128-lve, m3215, m3215-lve, m3216, m3216-lve, m3905-r, m4215-lv, m4215-v, m4216-lv, m4216-v, m4218-lv, m4218-v, m4225-lve, m4227-lve, m4228-lve, m4308-ple, m4317-plr, m4317-plve, m4318-plr, m4318-plve, m4327-p, m4328-p, m5000, m5000-g, m5074, m5075, m5075-g, m5526-e, m7104, m7116, p1245 mk ii, p1265 mk ii, p1275 mk ii, p1385, p1385-b, p1385-be, p1385-e, p1387, p1387-b, p1387-be, p1387-le, p1388, p1388-b, p1388-be, p1388-le, p1465-le, p1465-le-3, p1467-le, p1468-le, p1468-xle, p1475-le, p1518-e, p1518-le, p3265-lv, p3265-lve, p3265-lve-3, p3265-v, p3267-lv, p3267-lve, p3267-lve mic, p3268-lv, p3268-lve, p3268-slve, p3275-lv, p3275-lve, p3277-lv, p3277-lve, p3278-lv, p3278-lve, p3285-lv, p3285-lve, p3287-lv, p3287-lve, p3288-lv, p3288-lve, p3735-ple, p3737-ple, p3738-ple, p3747-plve, p3748-plve, p3818-pve, p3827-pve, p3905-r mk iii, p3925-lre, p3925-r, p3935-lr, p4705-plve, p4707-plve, p4708-plve, p5654-e, p5654-e mk ii, p5655-e, p5676-le, p7304, p7316, p9117-pv, q1615 mk iii, q1615-le mk iii, q1656, q1656-b, q1656-be, q1656-ble, q1656-dle, q1656-le, q1686-dle, q1715, q1728, q1728-le, q1798-le, q1800-le, q1800-le-3, q1805-le, q1806-le, q1808-le, q1809-le, q1961-te, q1961-xte, q1971-e, q1972-e, q2101-te, q2111-e, q2112-e, q3527-lve, q3536-lve, q3538-lve, q3538-slve, q3546-lve, q3548-lve, q3556-lve, q3558-lve, q3626-ve, q3628-ve, q3819-pve, q3839-pve, q3839-spve, q4809-pve, q6020-e, q6074, q6074-e, q6075, q6075-e, q6075-s, q6075-se, q6078-e, q6135-le, q6225-le, q6300-e, q6315-le, q6318-le, q6355-le, q6358-le, q8615-e, q8752-e, q8752-e mk ii, q9307-lv, s3008, s3008 mk ii, s3016, s4000, v5925, v5938, w100, w101, w102, w110, w120, w401, xc1311, xf40-q1785, xfq1656, xpq1785

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 2 |
| High | 21 |
| Medium | 32 |
| Low | 2 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-1287](https://radicalnotion.ai/cwe/cwe-1287) | Improper Validation of Specified Type of Input | 9 |
| [CWE-35](https://radicalnotion.ai/cwe/cwe-35) | Path Traversal: '.../...//' | 8 |
| [CWE-1286](https://radicalnotion.ai/cwe/cwe-1286) | Improper Validation of Syntactic Correctness of Input | 6 |
| [CWE-732](https://radicalnotion.ai/cwe/cwe-732) | Incorrect Permission Assignment for Critical Resource | 5 |
| [CWE-863](https://radicalnotion.ai/cwe/cwe-863) | Incorrect Authorization | 4 |
| [CWE-155](https://radicalnotion.ai/cwe/cwe-155) | Improper Neutralization of Wildcards or Matching Symbols | 3 |
| [CWE-78](https://radicalnotion.ai/cwe/cwe-78) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 3 |
| [CWE-367](https://radicalnotion.ai/cwe/cwe-367) | Time-of-check Time-of-use (TOCTOU) Race Condition | 2 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2021 | 3 |
| 2022 | 0 |
| 2023 | 9 |
| 2024 | 12 |
| 2025 | 23 |
| 2026 | 10 |

## Affected versions (top 26 of 219)

| Version | Kind | CVEs |
| --- | --- | --- |
| AXIS OS 5.51 | exact | 1 |
| AXIS OS 6.50 | exact | 1 |
| \< 11.7.57 | range | 3 |
| \< 10.7 | range | 2 |
| \>= 11.11 | range | 2 |
| \>= AXIS OS 5.51 or later | range | 2 |
| 10.0.0 \<= v \< 10.12.270 | range | 2 |
| 11.0.89 \<= v \< 11.6.94 | range | 2 |
| 11.11.0 \<= v \< 11.11.135 | range | 2 |
| 11.11.0 \<= v \< 12.2.52 | range | 2 |
| 12.0.0 \<= v \< 12.11.44 | range | 2 |
| 12.0.0 \<= v \< 12.2.52 | range | 2 |
| 12.0.0 \<= v \< 12.3.56 | range | 2 |
| 6.50.0 \<= v \< 6.50.5.19 | range | 2 |
| 11.7.57 | patched | 4 |
| 11.11.135 | patched | 3 |
| 11.6.94 | patched | 3 |
| 10.12.270 | patched | 2 |
| 10.7 | patched | 2 |
| 11.11.141 | patched | 2 |
| 12.11.44 | patched | 2 |
| 12.2.52 | patched | 2 |
| 12.3.56 | patched | 2 |
| 6.50.5.19 | patched | 2 |
| 6.50.5.21 | patched | 2 |
| 10.12.199 | patched | 1 |

## CVEs (first 30 of 57, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-4757 | A VAPIX API parameter had improper input validation which could allow code execution and... | high | 7.2 | No | No | Yes |
| CVE-2026-6505 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could... | medium | 5.1 | No | No | Yes |
| CVE-2026-5304 | An ACAP configuration file lacks input validation, which could potentially lead to privilege... | medium | 5.7 | No | No | Yes |
| CVE-2026-5303 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could... | medium | 5.7 | No | No | Yes |
| CVE-2026-6181 | The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can... | medium | 5.9 | No | No | Yes |
| CVE-2026-1185 | - | high | 8.8 | No | No | Yes |
| CVE-2026-0804 | - | high | 7.3 | No | No | Yes |
| CVE-2026-0802 | - | high | 7.3 | No | No | Yes |
| CVE-2026-0541 | - | high | 7.3 | No | No | Yes |
| CVE-2025-11142 | - | high | 8.8 | No | No | Yes |
| CVE-2025-9055 | - | medium | 6.4 | No | No | Yes |
| CVE-2025-8998 | - | low | 3.1 | No | No | Yes |
| CVE-2025-9524 | - | medium | 4.3 | No | No | Yes |
| CVE-2025-8108 | - | medium | 6.7 | No | No | Yes |
| CVE-2025-6779 | - | medium | 6.7 | No | No | Yes |
| CVE-2025-6571 | - | medium | 6.0 | No | No | Yes |
| CVE-2025-5452 | - | medium | 6.6 | No | No | Yes |
| CVE-2025-6298 | - | medium | 6.7 | No | No | Yes |
| CVE-2025-5718 | - | medium | 6.8 | No | No | Yes |
| CVE-2025-5454 | - | medium | 6.7 | No | No | Yes |
| CVE-2025-4645 | - | medium | 6.7 | No | No | Yes |
| CVE-2025-30027 | - | medium | 6.7 | No | No | Yes |
| CVE-2025-3892 | - | medium | 6.7 | No | No | Yes |
| CVE-2025-0358 | - | high | 8.8 | No | No | Yes |
| CVE-2025-0325 | - | medium | 4.3 | No | No | Yes |
| CVE-2025-0324 | - | critical | 9.4 | No | No | Yes |
| CVE-2025-0361 | - | medium | 5.3 | No | No | Yes |
| CVE-2024-47261 | - | medium | 4.3 | No | No | Yes |
| CVE-2025-0360 | - | high | 7.8 | No | No | Yes |
| CVE-2025-0359 | - | high | 8.5 | No | No | Yes |

## Frequently asked questions

### How many CVEs does Axis Communications AXIS OS have?

Axis Communications AXIS OS has 57 published CVE records since 2021.

### How many Axis Communications AXIS OS CVEs are in CISA KEV?

None of Axis Communications AXIS OS's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for Axis Communications AXIS OS vulnerabilities?

No Axis Communications AXIS OS CVEs currently have a tracked public exploit in this dataset.

### Which versions of Axis Communications AXIS OS are affected?

219 distinct Axis Communications AXIS OS versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in Axis Communications AXIS OS CVEs?

Axis Communications AXIS OS's CVEs most often map to these CWE weakness types: CWE-1287 (Improper Validation of Specified Type of Input), CWE-35 (Path Traversal: '.../...//'), CWE-1286 (Improper Validation of Syntactic Correctness of Input), CWE-732 (Incorrect Permission Assignment for Critical Resource).

### How many critical Axis Communications AXIS OS vulnerabilities are there?

Axis Communications AXIS OS has 2 critical and 21 high-severity CVEs.

### What is the average severity of Axis Communications AXIS OS CVEs?

The average CVSS base score across Axis Communications AXIS OS's scored CVEs is 6.7.

## Other products from this vendor

- [AXIS Camera Station Pro](https://radicalnotion.ai/vendor/axis/axis-camera-station-pro) (15 CVEs)
- [2100 network camera](https://radicalnotion.ai/vendor/axis/2100-network-camera) (12 CVEs)
- [camera station pro](https://radicalnotion.ai/vendor/axis/camera-station-pro) (11 CVEs)
- [axis os 2022](https://radicalnotion.ai/vendor/axis/axis-os-2022) (10 CVEs)
- [a1001](https://radicalnotion.ai/vendor/axis/a1001) (9 CVEs)
- [a1001 firmware](https://radicalnotion.ai/vendor/axis/a1001-firmware) (9 CVEs)
- [m1033-w](https://radicalnotion.ai/vendor/axis/m1033-w) (9 CVEs)
- [m1033-w firmware](https://radicalnotion.ai/vendor/axis/m1033-w-firmware) (9 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/axis/axis-os). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.