Axis OS CVE-2026-6505

Exploitation requires both of the following non-default, explicitly configured conditions to be present simultaneously: (1) the Axis device must be configured to allow installation of unsigned ACAP applications - this is a deliberately enabled administrative setting, not the factory default; and (2) an attacker must socially engineer a victim who holds high-privileged (administrative) access into installing a malicious ACAP application (UI:R, PR:H). Beyond these prerequisites, the attacker must also win a timing race condition (AC:H) between the application signature check and the subsequent file use during installation. Exploitation is categorically impossible against devices in default configuration where unsigned application installation is disabled. The combination of non-default configuration dependency, high privilege requirement, required user interaction, and race condition timing narrows the realistic attack surface to poorly-administered deployments that have explicitly relaxed application trust controls.

Real-world risk is materially lower than a surface reading of the vulnerability class might suggest. The CVSS 3.1 vector AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L encodes four significant exploitation barriers simultaneously: local attack vector (no remote exploitation path), high attack complexity (race condition requires precise timing), high privilege requirement (an administrator-level account must already be involved), and required user interaction (the privileged victim must actively install the malicious package). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA's KEV catalog, and no POC code has been identified. The High confidentiality impact (C:H) reflects that successful privilege escalation on a network camera could expose video feeds, credentials, and device configurations, but this impact is only reachable after clearing all the preceding barriers. In summary, this is a low-urgency finding for most organizations - the primary risk is in environments where unsigned ACAP installation is already permitted and administrative accounts are not tightly controlled.

An attacker targeting an Axis deployment where unsigned ACAP installation has been enabled crafts a malicious ACAP package that appears legitimate and delivers it to a high-privileged administrator via phishing or supply chain impersonation. During the installation process initiated by the victim, the attacker exploits the race window between the installer's signature check and the actual application deployment to substitute a malicious payload, achieving privilege escalation on the device. No public proof-of-concept code has been identified at time of analysis.