AXIS OS CVE-2026-0541

Two concrete prerequisites, both stated by the vendor, must hold: (1) the Axis device must be configured to allow installation of UNSIGNED ACAP applications - this is a non-default hardening-relevant setting, so devices left in the default signed-only mode are not exploitable; and (2) an attacker must convince a victim (an authorized operator with install rights) to install the attacker's malicious ACAP application, i.e. active user interaction is required (UI:R). Exploitation is further limited to local/on-device scope (AV:L) and to affected firmware AXIS OS 12.0.0 through below 12.9.32; the fixed version is 12.9.32. These limits - non-default configuration, authenticated/authorized installer, and required social engineering - substantially constrain real-world exploitability despite the total technical impact.

Signals align toward a genuine-but-low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R) describes a locally-scoped, authenticated flaw that additionally requires victim interaction, which is inconsistent with mass remote exploitation. This is reinforced by SSVC (Exploitation: none, Automatable: no, Technical Impact: total) and by an EPSS of 0.01% (1st percentile), indicating essentially no observed or predicted exploitation activity. There is no CISA KEV listing and no public exploit identified at time of analysis. The only elevated signal is Technical Impact: total, matching the C:H/I:H/A:H full-compromise outcome once the flaw is triggered. The vuln.today 'this_week' priority is therefore driven by the high impact and vendor-reported patch availability rather than by active exploitation. Net: this is a real, patch-worthy privilege-escalation issue but not a high-real-risk emergency - exploitation is gated behind a non-default configuration (unsigned ACAP allowed) and social engineering of an authorized operator. The signals are mutually consistent; no contradictions among CVSS, EPSS, KEV, and SSVC were found.

On an Axis device that an operator has configured to permit installation of unsigned ACAP applications, an attacker crafts a malicious ACAP package and persuades an authorized user to install it. Due to improper input validation during installation (CWE-732), the application gains privileges beyond those intended, resulting in full compromise of confidentiality, integrity, and availability on the device. No public exploit identified at time of analysis; the specific input-validation trigger is not described in the available sources.