Critical Security Vulnerability in Axis Camera Station: CVSS 9.9, Update Released
Axis Communications announced the CVE-2026-13312 vulnerability affecting AXIS Camera Station Pro and Camera Station 5 software. Patches have been released for the critical issue, rated CVSS 9.9. Other vulnerabilities disclosed on the same day also highlighted the importance of authorization and access control in video management systems.
Axis Communications published an official security bulletin on November 10, 2026, regarding a critical security vulnerability affecting its video management software.
The vulnerability, registered as CVE-2026-13312, received a CVSS 3.1 score of 9.9, classifying it as critical.
The security vulnerability affects specific versions of AXIS Camera Station Pro and AXIS Camera Station 5 software. The manufacturer states that the issue could allow an attacker to compromise the system.
According to Axis' statement, the vulnerability was identified by security researcher Ryan Vinton, who participated in the company's Camera Station Pro bug bounty program.
While the manufacturer announced that it would not share the technical details of the vulnerability, it stated that updates are available for affected systems.
Which AXIS Camera Station Versions Are Affected?
According to the security bulletin and CVE records published by Axis, the following software versions are affected:
AXIS Camera Station Pro
Affected versions: 6.0 and later, prior to 6.17
Fixed version: 6.17
AXIS Camera Station 5
Affected versions: 5.0 and later, prior to 5.59 SR 2
Fixed version: 5.59 SR 2
These versions are the remediation thresholds disclosed for CVE-2026-13312. Due to other security issues in the same software, more up-to-date versions supported by the manufacturer may be required.
An important distinction here is that the disclosed vulnerability is not directly in the hardware of a specific IP camera model, but rather in the software used to manage the cameras.
Therefore, a system using only Axis brand cameras does not necessarily mean it is affected by this vulnerability. It is necessary to check whether the relevant Camera Station software is in use and what its installed version is.
What Does a CVSS Score of 9.9 Mean?
The CVSS 3.1 vector published for CVE-2026-13312 is as follows:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
This assessment indicates that the vulnerability can be exploited over the network and has low attack complexity.
However, correctly interpreting the score is important. The CVSS record states that the attack requires existing low-privileged access. Therefore, it is incorrect to describe the vulnerability as an unauthenticated remote attack.
The assessment also indicates that a successful exploit could have a high impact on confidentiality, integrity, and availability.
However, the manufacturer has not disclosed the exact operations through which the attack can be carried out.
Therefore, based on the available information, it cannot be concluded that video recordings can be definitively compromised, remote code execution is possible, or cameras can be directly controlled.
Other Vulnerabilities Also Disclosed on the Same Day
On November 10, 2026, Axis also published records of other security issues related to the Camera Station product family.
Among these, CVE-2026-12964 is described as a vulnerability in AXIS Camera Station Pro software that could allow an account with viewer privileges to gain administrator privileges.
The issue, rated CVSS 8.0, is associated with the Server-Side Request Forgery (SSRF) vulnerability class.
According to Axis' official bulletin, Camera Station Pro versions between 6.6 and 6.17 are affected. The fix is available in version 6.18.
Also disclosed on the same day, CVE-2026-8372 has a CVSS score of 8.8. The manufacturer's CVE record identifies an unauthorized access risk in Camera Station Pro versions 6.13 and later, prior to 6.18.
The CVSS assessment for this vulnerability indicates that user interaction is required for the attack.
Another finding, CVE-2026-12963, relates to a viewer account being able to gain unauthorized access to network storage resources connected to the server.
This vulnerability demonstrates that video management systems require separate security controls not only for camera feeds but also for the storage infrastructure where recordings are kept.
Does Axis State That the Vulnerabilities Are Being Exploited?
Axis's CVE-2026-13312 security bulletin states that as of November 10, 2026, there is no publicly known exploit, and the manufacturer is not aware of the vulnerability being exploited.
A similar statement is included in the CVE-2026-12964 security bulletin.
However, the absence of a known attack does not mean the vulnerability is insignificant.
Once vulnerabilities are published and affected versions and fixes become public, it means system administrators should not delay their update plans.
On the other hand, the publication of a CVE record alone does not prove that an actual attack incident has occurred.
Why Are Camera Management Servers Critical?
Video management systems are used for the centralized monitoring and management of numerous cameras.
These systems can manage camera connections, user roles, viewing permissions, and in some installations, recording storage infrastructure.
Therefore, in security design, not only the network connections of the cameras but also the VMS server itself must be protected.
Especially in corporate networks, access permissions to camera management systems should be carefully planned. Granting administrator privileges to every operator can create an unnecessary security risk.
Furthermore, instead of management interfaces being directly accessible over the internet, appropriate secure remote access methods should be considered.
Connections between the camera network, management servers, and other corporate systems should also be restricted based on authorization and necessity.
What Should Integrators and Organizations in Turkey Do?
For security integrators, system administrators, and corporate customers using Axis Camera Station in Turkey, the first step should be to determine the current software version.
The recommended sequence of checks is as follows:
- Identify the installed AXIS Camera Station product and its exact version number.
- Compare the version with the affected range in the relevant CVE record.
- Check Axis's latest security bulletins and release notes.
- Securely back up system configurations and necessary data before updating.
- Apply the manufacturer's recommended update during an appropriate maintenance window.
- Verify camera connections, user permissions, and recording functionalities after the update.
Especially in critical infrastructures, hospitals, manufacturing facilities, logistics centers, and businesses with extensive camera networks, maintenance work needs to be planned with operational continuity in mind.
In conclusion, CVE-2026-13312 reminds us that camera security is not solely about device firmware. Video management servers, user permissions, and recording infrastructures are also fundamental components of the system's security integrity.
Axis's statements from November 10, 2026, highlight the importance of regularly updating these components and restricting access permissions.
Resources
Axis Communications — Official security bulletin for CVE-2026-13312, November 10, 2026
https://www.axis.com/dam/public/e4/2d/85/cve-2026-13312pdf-en-US-561251.pdf
CVE Program — CVE-2026-13312 record published by Axis, November 10, 2026
https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/13xxx/CVE-2026-13312.json
Axis Communications — Official security bulletin for CVE-2026-12964, November 10, 2026
https://www.axis.com/dam/public/50/3b/39/cve-2026-12964pdf-en-US-561250.pdf
CVE Program — Official record for CVE-2026-8372, November 10, 2026
https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/8xxx/CVE-2026-8372.json
CVE Program — Official record for CVE-2026-12963, November 10, 2026
https://www.axis.com/dam/public/50/3b/39/cve-2026-12964pdf-en-US-561250.pdf