CVE-2026-1185

HighCVSS 8.8/10Last modified Oct 26, 2026

Description

A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
Axis Communications AB	AXIS OS	>= 12.0.0, < 12.10.36

References

https://www.axis.com/dam/public/69/df/8d/cve-2026-1185pdf-en-US-530733.pdfVendor Advisory

Timeline

Published: May 12, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-118505.0An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.CVE-2026-1185006.4The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via CVE-2026-1185046.5The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whe CVE-2026-1185056.3Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacke CVE-2026-118515.9Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router CVE-2026-1185108.8A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related r CVE-2026-1185137.7Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.CVE-2026-1185146.3In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and Reques CVE-2026-1185158.4The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property type CVE-2026-1185166.3The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based au CVE-2026-1185174.3The Symfony HtmlSanitizer component UrlSanitizer parses URLs differently from browsers, allowing the allowLinkHosts() and allowMediaHosts() CVE-2026-118526.5Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debusine are organized in