CVE-2026-63287 PUBLISHED

Assigner: Axis
Reserved: 16.07.2026 Published: 10.11.2026 Updated: 10.11.2026

It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Axis Communications AB
Product	AXIS Camera Station Pro
Versions	Default: unaffected affected from 6.0 to 6.18 (excl.)

Vendor	Axis Communications AB
Product	AXIS Camera Station 5
Versions	Default: unaffected affected from 5.0 to 5.59 (excl.)

Credits

Maciej 'mace' Nowak finder

References

https://www.axis.com/dam/public/bc/65/61/cve-2026-63287pdf-en-US-561253.pdf

Problem Types

CWE-117: Improper Output Neutralization for Logs CWE
CWE-863: Incorrect Authorization CWE