This vulnerability (CVE-2026-0804) affects AXIS OS 12.0.0 by allowing a path traversal attack through insufficient input validation in an ACAP configuration file. Successful exploitation could lead to privilege escalation on the device. However, exploitation prerequisites include the device being configured to allow unsigned ACAP application installation and user consent to install a malicious ACAP application. The CVSS 3.1 base score is 6.7 (medium severity) with attack vector local, low attack complexity, high privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

If exploited, an attacker could escalate privileges on the affected device, potentially gaining unauthorized access or control. The impact affects confidentiality, integrity, and availability of the device. However, exploitation requires local access with high privileges and user installation of a malicious ACAP application, limiting the attack surface. No known exploits are reported in the wild.

No official patch or remediation level has been provided by Axis Communications AB as of the published date. Since exploitation requires allowing unsigned ACAP applications and user installation of malicious apps, it is recommended to disable installation of unsigned ACAP applications if possible. Monitor the vendor advisory for updates regarding patches or official mitigations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.