CVE-2026-63286

State: Published
Severity: 7.1 High
Published: Oct 28, 2026
Updated: Oct 28, 2026
Reserved: Jul 16, 2026

Description

Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the credentials stored in AXIS Camera Station Pro.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	Axis

Weaknesses

CWE-326 Inadequate Encryption Strength

Affected Products

Product	Versions
AXIS Camera Station ProAxis Communications AB	6.0 to before 6.20Affected
AXIS Camera Station 5Axis Communications AB	5.00 and laterAffected

References

https://www.axis.com/dam/public/c9/5c/29/cve-2026-63286pdf-en-US-560650.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.