This vulnerability (CVE-2026-4757) affects AXIS OS version 12.0.0 and is caused by incorrect permission assignment and improper input validation in a VAPIX API parameter. An attacker with administrator-level credentials could exploit this flaw to execute arbitrary code and escalate privileges. The CVSS 3.1 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could lead to remote code execution and privilege escalation on the affected device, compromising confidentiality, integrity, and availability. However, exploitation requires prior authentication with an administrator-privileged account, limiting the attack surface to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator account access and monitor for suspicious activity involving VAPIX API usage by privileged accounts.