The Device Configuration Framework in AXIS OS contains an authentication bypass vulnerability (CVE-2026-6181) classified under CWE-290. Exploitation requires an attacker to first authenticate using a viewer-privileged service account. Once authenticated, the attacker can bypass further authentication mechanisms, potentially compromising confidentiality and integrity of the system. The vulnerability affects AXIS OS versions 11.11.0 and 12.0.0. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability allows an attacker with viewer-level authentication to bypass additional authentication controls, leading to high confidentiality and integrity impact. This could enable unauthorized access to sensitive device configuration or control functions. Availability impact is not affected. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor Axis Communications advisories for updates. Restricting access to viewer-privileged accounts and ensuring strong authentication controls may reduce risk until a fix is available.