{"id":"CVE-2026-14543","aliases":[],"cve":{"records":[{"id":"CVE-2026-14543","source":"Axis","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-03T06:01:02.000Z","published":"2026-11-10T05:20:29.154Z","modified":"2026-11-12T17:11:50.904Z"}],"publishers":[{"name":"Axis","role":"CNA","organizationId":"f2daf9a0-02c2-4b83-a01d-63b3b304b807","modified":"2026-11-10T05:20:29.154Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T17:11:50.904Z"}],"references":[{"url":"https://www.axis.com/dam/public/cd/92/6b/cve-2026-14543pdf-en-US-561257.pdf","tags":[],"source":"Axis"}],"weaknesses":[{"id":"CWE-1287","description":"CWE-1287: Improper Validation of Specified Type of Input","source":"Axis"},{"id":"CWE-732","description":"CWE-732: Incorrect Permission Assignment for Critical Resource","source":"Axis"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T17:11:36.936658Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected…","titleSource":"Axis","descriptionSource":"Axis","description":"The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.","score":3.9,"severity":"low","published":"2026-11-10T05:20:29.154Z","modified":"2026-11-12T17:11:50.904Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Axis Communications AB","name":"AXIS OS","platforms":[],"versions":[{"version":"13.0.0","status":"affected","lessThan":"13.0.42","versionType":"semver"},{"version":"12.0.0","status":"affected","lessThan":"12.11.84","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Axis","url":"https://www.cve.org/CVERecord?id=CVE-2026-14543"}],"remediation":[],"references":["https://www.axis.com/dam/public/cd/92/6b/cve-2026-14543pdf-en-US-561257.pdf"],"sources":[{"name":"CVE","id":"CVE-2026-14543","modified":"2026-11-12T17:11:50.904Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-14543"}],"assessments":[{"source":"Axis","vector":"CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":3.9}],"sourceAffected":[],"observedAt":"2026-11-12T19:02:20.200Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:20:33.177Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T05:35:32.099Z","attemptedAt":"2026-11-10T05:35:32.099Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T05:35:31.925Z","attemptedAt":"2026-11-10T05:35:31.925Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T05:35:31.775Z","attemptedAt":"2026-11-10T05:35:31.775Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T05:35:31.796Z","attemptedAt":"2026-11-10T05:35:31.796Z"}],"evidence":[],"aiSummary":{"text":"The VAPIX Edge storage API in AXIS OS versions 13.0.0 to 13.0.41 and 12.0.0 to 12.11.83 has a weakness that can escalate user privileges, granting unauthorized access to protected system resources after admin-privileged authentication. The flaw circumvents filesystem isolation. Impact requires authenticated access.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T05:31:01.444Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-14543"}]}}