Axis OS CVE-2026-4757

Exploitation requires the attacker to authenticate using an administrator-privileged service account on the target Axis OS device - this is explicitly stated in the CVE description and confirmed by CVSS PR:H. This is the primary limiting condition: without valid admin credentials, the vulnerability cannot be reached. The device must also expose the VAPIX API over the network (standard for Axis devices in operational use). There is no requirement for user interaction (UI:N). What limits real-world exploitation: the attacker must first obtain or compromise an administrator-level service account; this may be through credential theft, reuse, or insider access. The attack is not exploitable by unauthenticated remote attackers or by lower-privileged (non-admin) accounts. Default-configured Axis deployments with VAPIX exposed only on internal management networks further constrain the attack surface.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects a network-reachable, low-complexity exploit constrained to attackers who already hold administrator-level service account credentials (PR:H). The full C/I/A:H triad indicates the device can be fully compromised - code execution plus privilege escalation means an attacker can read camera feeds, alter configurations, install persistent malware, or render the device inoperable. No EPSS score was provided, and the absence from CISA KEV and lack of any known POC suggests opportunistic mass exploitation is not currently occurring. The realistic risk is therefore primarily elevated in scenarios where: (a) Axis service accounts are shared, reused, or exposed via compromised credential stores; (b) VAPIX management interfaces are Internet-exposed rather than isolated on a management VLAN; or (c) an attacker has already achieved lateral movement to a position with admin credentials. Despite the high CVSS base score, the PR:H prerequisite materially narrows the realistic attacker population compared to unauthenticated network flaws.

An attacker who has compromised an Axis administrator-level service account credential - through phishing, credential reuse from another breach, or insider access - authenticates to the VAPIX API over the network and sends a request containing a maliciously crafted parameter value. The improper input validation flaw allows the malicious input to trigger code execution within the context of a process running with elevated permissions, effectively giving the attacker privileged control over the Axis OS device. No public proof-of-concept exploit code has been identified at time of analysis.