PT-2026-39940 · Axis · Acap

Mucoze · Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-0804

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Axis ACAP (affected versions not specified)

Description An ACAP configuration file lacks sufficient input validation, enabling a path traversal attack—a method where an attacker accesses files and directories outside the intended folder—which could lead to privilege escalation. Exploitation requires the Axis device to be configured to allow the installation of unsigned ACAP applications and for a victim to be convinced to install a malicious ACAP application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2026-0804

Affected Products

Acap

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-0804 · Security Note
• https://axis.com/dam/public/51/64/ea/cve-2026-0804pdf-en-US-530732.pdf · Vendor Advisory
• https://t.me/CVEtracker/53466 · Telegram Post
• https://t.me/cveNotify/163178 · Telegram Post