The vulnerability CVE-2026-0802 in AXIS OS 12.0.0 arises from improper validation of input types in an ACAP configuration file, classified under CWE-1287. This can enable command injection attacks potentially resulting in privilege escalation. Exploitation is conditional on the device allowing unsigned ACAP application installations and the victim installing a malicious ACAP app. The CVSS 3.1 base score is 6.0, reflecting local attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability. No patch or official remediation level has been published by Axis Communications as of the publication date.

Successful exploitation could lead to command injection and privilege escalation on affected AXIS OS devices, compromising confidentiality and integrity of the system. However, exploitation requires the device to be configured to allow unsigned ACAP applications and the victim to install a malicious application, limiting the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configuring devices to allow installation of unsigned ACAP applications and do not install ACAP applications from untrusted sources.