CVE-2026-63287

MediumCVSS 6.5/10Last modified Nov 12, 2026

Description

It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-117 CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Axis Communications AB	AXIS Camera Station Pro	>= 6.0, < 6.18
Axis Communications AB	AXIS Camera Station 5	>= 5.0, < 5.59

References

https://www.axis.com/dam/public/bc/65/61/cve-2026-63287pdf-en-US-561253.pdf

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-632888.3A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authen CVE-2026-63296.5PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched M CVE-2026-632927.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a rem CVE-2026-632939.9A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When import CVE-2026-632949.9A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpackin CVE-2026-632954.3An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When CVE-2026-632969.9An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migratio CVE-2026-632979.9An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass ta CVE-2026-632989.9An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacke CVE-2026-632999.9An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code p CVE-2026-63306.5The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection an CVE-2026-633009.9An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker w