CVE-2026-0541: ACAP Privilege Escalation Vulnerability

CVE-2026-0541 Overview

CVE-2026-0541 is a privilege escalation vulnerability affecting Axis devices that support AXIS Camera Application Platform (ACAP) applications. The flaw stems from improper input validation during the ACAP application installation process, classified as [CWE-732] Incorrect Permission Assignment for Critical Resource. A malicious ACAP application can gain elevated privileges on the device once installed. Exploitation requires the Axis device to be configured to allow installation of unsigned ACAP applications and requires user interaction to install the malicious package.

Critical Impact
A successful attack grants elevated privileges on the Axis device, compromising confidentiality, integrity, and availability of camera operations and stored data.

Affected Products

Axis devices supporting ACAP application installation
Axis devices configured to allow unsigned ACAP applications
Refer to the Axis Security Advisory CVE-2026-0541 for the complete affected product list

Discovery Timeline

2026-05-12 - CVE-2026-0541 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-0541

Vulnerability Analysis

The vulnerability resides in the ACAP application installation routine on Axis devices. The installation process fails to properly validate input supplied within the ACAP application package. An attacker who crafts a malicious ACAP package can leverage this gap to assign higher privileges to application components than intended. The result is local privilege escalation on the Axis device. Because Axis devices are commonly deployed in physical security environments, an attacker with elevated privileges can manipulate video streams, alter device configuration, and pivot within operational technology networks.

Root Cause

The root cause is improper input validation during ACAP application installation, mapped to [CWE-732]. The installer trusts metadata or attributes contained in the application package without enforcing privilege boundaries. This permits installed components to execute with privileges that exceed what an untrusted application should hold.

Attack Vector

Exploitation requires local access to the device administration interface and high privileges to initiate installation. Two preconditions must be met: the device must be configured to permit unsigned ACAP applications, and an administrator must be convinced to install the attacker's malicious application. User interaction is not required at the protocol level once installation begins. The vulnerability cannot be exploited remotely without first obtaining administrative credentials or social engineering an administrator.

No public proof-of-concept or exploitation code is available. Refer to the Axis Security Advisory CVE-2026-0541 for vendor-supplied technical details.

Detection Methods for CVE-2026-0541

Indicators of Compromise

Installation of unsigned or unexpected ACAP applications on Axis devices
Configuration changes that enable installation of unsigned ACAP packages
New processes or services running on the device with elevated privileges following an application install
Unexpected outbound network connections originating from Axis devices

Detection Strategies

Audit device configuration to confirm whether unsigned ACAP installation is enabled
Maintain an inventory of approved ACAP applications and compare against deployed packages
Monitor device system logs for ACAP installation events and privilege assignment activity
Alert on administrative authentication to Axis device management interfaces from atypical sources

Monitoring Recommendations

Forward Axis device syslog output to a centralized log management or SIEM platform for correlation
Track firmware versions across the Axis fleet and flag devices missing the security update
Segment camera networks and monitor east-west traffic for lateral movement attempts from camera subnets

How to Mitigate CVE-2026-0541

Immediate Actions Required

Disable installation of unsigned ACAP applications on all Axis devices
Restrict administrative access to Axis device management interfaces using network segmentation and strong authentication
Audit installed ACAP applications and remove any that are unauthorized or unrecognized
Apply the firmware update referenced in the Axis Security Advisory CVE-2026-0541 once available for affected models

Patch Information

Axis Communications has published a security advisory describing the issue and the affected products. Administrators should consult the Axis Security Advisory CVE-2026-0541 for vendor-provided patched firmware versions and upgrade guidance.

Workarounds

Configure the device to require signed ACAP applications only, blocking the precondition required for exploitation
Limit administrative accounts on Axis devices and rotate credentials following the principle of least privilege
Install ACAP applications only from trusted, verified sources and validate package signatures before deployment
Place camera infrastructure on isolated VLANs with strict egress filtering to limit post-exploitation impact