What is the CVSS score of CVE-2026-6181?

CVE-2026-6181 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-6181?

Yes, a patch is available for CVE-2026-6181. Update the affected software to the latest version immediately.

Axis OS CVE-2026-6181

EUVD-2026-55962 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-08-11 Axis

GHSA-wr2x-95cv-cwrg

Authentication Bypass Axis Os Axis Communications Ab

5.9

CVSS 3.1 · Vendor: Axis

Severity by source

Vendor (Axis) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Viewer account is lowest Axis OS privilege tier, making PR:L more accurate than the vendor-assigned PR:H; AC:H retained for non-trivial bypass conditions.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Axis).

CVSS VectorVendor: Axis

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 11, 2026 - 07:02 EUVD

Analysis Generated

Aug 11, 2026 - 06:21 vuln.today

DescriptionCVE.org

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account.

AnalysisAI

Authentication bypass in the Device Configuration Framework of Axis OS (CWE-290) enables an already-authenticated attacker holding a viewer-privileged service account to circumvent authorization controls and gain unauthorized access to device configuration with high confidentiality and integrity impact. The vulnerability is network-exploitable but constrained by the requirement for prior authentication and high attack complexity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.

Technical ContextAI

CWE-290 (Authentication Bypass by Spoofing) describes flaws where an implementation incorrectly validates or enforces authentication, allowing an already-authenticated but low-trust principal to impersonate a higher-privilege role or bypass authorization gates entirely. The affected component is the Device Configuration Framework within Axis OS - the operating system running on Axis Communications AB network video and IoT devices (CPE: cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*). Axis OS devices typically implement tiered privilege levels (viewer, operator, administrator); this vulnerability allows the viewer tier, normally restricted from configuration changes, to bypass the framework's authorization checks. The network-accessible nature (AV:N) indicates the configuration framework exposes a remotely reachable interface.

RemediationAI

Consult the Axis advisory at https://www.axis.com/dam/public/9d/8a/ea/cve-2026-6181pdf-en-US-543646.pdf for the patched Axis OS version and upgrade instructions; a specific fixed version number was not available in the data used for this analysis. As a compensating control while patching, restrict or disable viewer-privileged service accounts on devices where they are not operationally required - this directly removes the prerequisite for exploitation. Additionally, ensure management and configuration interfaces are not exposed to untrusted networks: place devices behind a dedicated management VLAN and enforce firewall rules to limit access to the Device Configuration Framework endpoint. Rotate all service account credentials on affected devices as a precaution, particularly any viewer-role accounts shared across multiple systems. Note that disabling service accounts may break automated integrations that rely on them, so audit dependencies before removal.