Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-13312 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | Axis Communications |
| Product | AXIS Camera Station Pro / AXIS Camera Station |
| Vulnerability Type | Improper Validation of Specified Type of Input (CWE-1287) |
| Affected Versions | AXIS Camera Station Pro < 6.17, AXIS Camera Station < 5.59 SR 2 |
| CVSS Score | 9.9 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD, Axis Communications
A vulnerability that could allow an attacker to compromise a system.
According to the Axis security advisory (“Security Advisory CVE-2026-13312”, version 1.0, 10 November 2026), the vulnerability affects AXIS Camera Station Pro versions earlier than 6.17 and AXIS Camera Station versions earlier than 5.59 SR 2. The vendor rated it CVSS v3.1 9.9 (critical) and classified it as CWE-1287 — Improper Validation of Specified Type of Input.
The vulnerability was reported by Ryan Vinton through the AXIS Camera Station Pro Bug Bounty Program. Axis does not provide technical details — it does not describe the affected component, the attack vector or the conditions for exploitation. To the vendor’s knowledge, there are no public exploits and the vulnerability has not been exploited in attacks. NVD does not list a CPE configuration.
Required Actions
- Update AXIS Camera Station Pro to version 6.17 and AXIS Camera Station to version 5.59 SR 2 — both contain the fix. Axis recommends updating to AXIS Camera Station 5 or moving to AXIS Camera Station Pro.
- Restrict network access to the VMS server: the AXIS Camera Station server should not be reachable from the internet, and access should be limited to operator workstations and the camera network segment.
- Inventory AXIS Camera Station installations across the organization — including branch offices, warehouses and systems maintained by physical security integrators — and check their versions.
Who Is Affected?
This vulnerability affects AXIS Camera Station Pro (versions < 6.17) and AXIS Camera Station (versions < 5.59 SR 2) — the Axis Communications VMS (Video Management System) used to manage cameras and recordings. Axis video surveillance systems are used by manufacturing plants, logistics centers, offices, retail chains and public institutions. These systems are often deployed and maintained by an external integrator, so it is worth confirming who is responsible for updating the VMS server.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-13312 vulnerability?
CVE-2026-13312 is a critical vulnerability (CVSS 9.9) in the AXIS Camera Station Pro and AXIS Camera Station video management software, classified as CWE-1287 (Improper Validation of Specified Type of Input). According to the vendor, it could allow an attacker to compromise a system.
Which versions are affected by CVE-2026-13312?
AXIS Camera Station Pro versions earlier than 6.17 and AXIS Camera Station versions earlier than 5.59 SR 2 are affected. The fixes are included in AXIS Camera Station Pro 6.17 and AXIS Camera Station 5.59 SR 2.
Is CVE-2026-13312 being exploited?
To Axis's knowledge at the time of the advisory (10 November 2026), there are no public exploits and the vulnerability has not been exploited. The vendor does not disclose technical details of the vulnerability.
How to protect against CVE-2026-13312?
Update AXIS Camera Station Pro to version 6.17 and AXIS Camera Station to version 5.59 SR 2. Until the update is applied, restrict network access to the VMS server to trusted workstations and network segments only.
Who is affected by CVE-2026-13312?
It affects organizations that manage Axis-based video surveillance with AXIS Camera Station Pro or AXIS Camera Station, including manufacturing plants, warehouses, offices, retail sites and public institutions.
