CVE-2026-63282

MediumCVSS 6.5/10Last modified Nov 12, 2026

Description

Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-1287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Axis Communications AB	AXIS OS	>= 13.0.0, < 13.0.84; >= 12.0.0, < 12.11.123; >= 11.0.0, < 11.11.231; >= 10.0.0, < 10.12.354; >= 9.0.0, < 9.80.153; >= 7.0.0, < 8.40.112; >= 6.0.0, < 6.50.5.23

References

https://www.axis.com/dam/public/c5/06/79/cve-2026-63282pdf-en-US-561259.pdf

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-632867.1Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS CVE-2026-632876.5It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could b CVE-2026-632888.3A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authen CVE-2026-63296.5PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched M CVE-2026-632927.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a rem CVE-2026-632939.9A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When import CVE-2026-632949.9A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpackin CVE-2026-632954.3An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When CVE-2026-632969.9An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migratio CVE-2026-632979.9An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass ta CVE-2026-632989.9An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacke CVE-2026-632999.9An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code p