AXIS OS CVE-2026-1185

The attacker must be able to log in to the target Axis device over SSH with valid credentials (CVSS PR:L; the vendor states exploitation is possible ONLY with SSH login), and the device must be running an affected AXIS OS build (12.0.0 up to but not including 12.10.36). Given SSH access, the attacker writes to a specific local configuration file whose input is improperly validated (CWE-732), yielding code execution and potential privilege escalation. Limiting factors: no anonymous/unauthenticated path exists - SSH access to Axis devices is credential-gated and typically not exposed to untrusted networks by default; no user interaction by a victim is required (UI:N), but the credential prerequisite is the decisive constraint on real-world exploitability. The exact configuration file and the nature of the validation failure are not described in the available sources.

The signals point to a serious-but-gated issue rather than a drop-everything emergency. The CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N, total C/I/A impact) is driven high by the complete technical impact and low attack complexity, and SSVC confirms Technical Impact: total. However, the network vector (AV:N) must be read against the vendor's explicit precondition: the flaw 'can only be exploited if an attacker can log in to the Axis device using SSH.' This reconciles with PR:L (the attacker needs valid, if low-privilege, device credentials) - AV:N is accurate only in the sense that SSH is reached over the network, not that this is remote-unauthenticated. Every exploitation-likelihood signal is low: EPSS is 0.05% (17th percentile), SSVC Exploitation is 'none', SSVC Automatable is 'no', there is no CISA KEV listing, and no public exploit was identified. The vuln.today priority is 'this_week' - meaning prioritized remediation within the patch cycle, not act_now/emergency. Net: a high-severity, high-impact flaw whose real-world risk is substantially constrained by the SSH-authentication prerequisite and the absence of any exploitation activity. Treat it as a this-week patching priority for exposed/SSH-enabled Axis fleets, not a widespread active-exploitation crisis.

An attacker who already holds SSH login access to an Axis device (for example via stolen, default, or shared operator credentials) logs in and writes malicious content into a configuration file on the local file system. Because that file's input is improperly validated, the crafted content is processed and leads to code execution, potentially escalating the attacker's privileges on the device. No public exploit code was identified at time of analysis, so this is a plausible path derived from the vendor description rather than a demonstrated PoC.