CVE-2026-13409 is a vulnerability in the VAPIX API's dynamicoverlay.cgi endpoint that causes a denial-of-service (DoS) affecting the overlay functionality. Exploitation requires authentication with an operator or admin-privileged service account. The vulnerability does not impact confidentiality or integrity but results in availability loss of the overlay feature.