CVE-2026-5304: Axis ACAP Privilege Escalation Vulnerability

CVE-2026-5304 Overview

CVE-2026-5304 is an input validation flaw in an AXIS Camera Application Platform (ACAP) configuration file on Axis devices. The missing validation can lead to privilege escalation on the device. Exploitation requires the Axis device to be configured to allow installation of unsigned ACAP applications. An attacker must also convince a victim with the required privileges to install a malicious ACAP application. The weakness is tracked under CWE-1287, Improper Validation of Specified Type of Input.

Critical Impact
A successful attack lets a malicious ACAP application escalate privileges on the Axis device, compromising confidentiality and integrity of the host.

Affected Products

Axis devices running ACAP applications (see Axis Security Advisory CVE-2026-5304 for the model and firmware matrix)
Devices configured to allow installation of unsigned ACAP applications
Deployments where administrators can be induced to install untrusted ACAP packages

Discovery Timeline

2026-08-11 - CVE-2026-5304 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-5304

Vulnerability Analysis

The vulnerability resides in an ACAP configuration file that fails to validate the input it consumes. ACAP is Axis's application platform for running third-party software on Axis network cameras and other edge devices. Because the configuration file is parsed by a component running with elevated privileges, unchecked input processed from a malicious ACAP application can influence privileged behavior. The result is privilege escalation from the ACAP application context to a higher-privileged context on the device.

Exploitation is gated by two preconditions. First, the device must permit installation of unsigned ACAP applications, which is not the default hardened posture. Second, an attacker must convince an authorized user to install the malicious ACAP package, requiring user interaction and high privileges.

Root Cause

The root cause is improper validation of specified input types [CWE-1287] within an ACAP configuration file. Values read from the file are trusted without type or content checks. A malicious ACAP application can supply crafted configuration content that the privileged parser accepts and acts upon.

Attack Vector

The attack vector is network-adjacent through the ACAP installation workflow. An attacker packages a malicious ACAP application containing a crafted configuration file. An administrator with installation rights uploads the application on a device configured to allow unsigned ACAP packages. When the configuration file is processed, the missing validation allows the application to escalate privileges on the device.

No verified public exploit or proof-of-concept code is available. Refer to the Axis Security Advisory CVE-2026-5304 for vendor-supplied technical details.

Detection Methods for CVE-2026-5304

Indicators of Compromise

Installation events for unsigned or unexpected ACAP applications on Axis devices
New or modified ACAP configuration files containing unexpected fields, path references, or shell metacharacters
Processes on Axis devices running with elevated privileges that originate from an ACAP application context
Outbound connections from Axis devices to unfamiliar hosts following an ACAP install

Detection Strategies

Audit device configuration to enumerate any Axis camera permitting unsigned ACAP installation
Compare installed ACAP application inventories against an approved allowlist
Alert on administrative logins to Axis device management interfaces followed by ACAP upload actions
Correlate firmware and ACAP install events with subsequent privilege changes on the device

Monitoring Recommendations

Forward Axis device syslog and audit events into a central SIEM for retention and correlation
Track HTTPS management sessions and ACAP install API calls against known administrator identities
Monitor network segments hosting Axis devices for unexpected lateral movement or command-and-control patterns
Review Axis vendor advisories on a scheduled cadence and trigger detection updates on new CVEs

How to Mitigate CVE-2026-5304

Immediate Actions Required

Apply the firmware update referenced in the Axis Security Advisory CVE-2026-5304 on all affected devices
Disable installation of unsigned ACAP applications on every Axis device that does not require it
Restrict administrative access to Axis management interfaces to a small set of named accounts
Remove any ACAP applications whose provenance cannot be verified

Patch Information

Axis has published a security advisory for CVE-2026-5304 with affected products and fixed firmware versions. Consult the Axis Security Advisory CVE-2026-5304 for the authoritative list of fixed builds and upgrade instructions.

Workarounds

Enforce a signed-only ACAP installation policy on all production Axis devices
Place Axis devices on isolated VLANs with strict egress filtering to limit post-exploitation impact
Require multi-party approval before installing any ACAP application in operational environments
Rotate administrator credentials for Axis devices and disable unused accounts

bash

# Configuration example
# Verify unsigned ACAP installation is disabled via the Axis VAPI
# Replace <device>, <user> with environment-specific values
curl -k -u <user> \
  "https://<device>/axis-cgi/param.cgi?action=list&group=Network.ACAP"

# Expected: parameter enforcing signed-only installation is set to 'yes'
# If unsigned installs are enabled, disable them:
curl -k -u <user> \
  "https://<device>/axis-cgi/param.cgi?action=update&Network.ACAP.AllowUnsigned=no"