# CERT-FR Flags Multiple Axis Product Vulnerabilities

Published: 2026-11-12 · Severity: routine · Sectors: Infrastructure, Government (National), Retail, Transportation, Manufacturing
Canonical: https://vorant.io/reports/bb6bc6ab-58c0-5d42-b7b2-9c7e98f470b0/cert-fr-flags-multiple-axis-product-vulnerabilities
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory lists 16 CVEs in Axis Camera Station, AxisOS and related products enabling RCE, privilege escalation and DoS; patches available.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1523

## What to check

- Applies to: The 16 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR has published an advisory consolidating multiple vulnerabilities disclosed by Axis Communications affecting a range of its video surveillance and access control products, including Axis Camera Station Pro, Axis Camera Station, Axis File Player, Axis Secure Entry, Axis Signed Media Verifier, Axis Signed-Video-Framework, and several AxisOS branches (LTS 2022, LTS 2024, LTS 2026, and the active track). The 16 CVEs referenced span risks including remote arbitrary code execution, privilege escalation, remote denial of service, data integrity and confidentiality compromise, and security policy bypass.

No evidence of active exploitation is mentioned in the advisory; it is a standard vendor-coordinated disclosure with patches available. Affected organizations operating Axis camera systems, access control, or media verification software should consult the vendor's individual security bulletins (each CVE has a corresponding Axis PDF bulletin dated 11 November 2026) and update to the fixed versions specified: AxisOS 6.50.5.23+, 8.40.112+, 9.80.153+, Active track 13.0.83+, LTS 2022 10.12.352+, LTS 2024 11.11.228+, LTS 2026 12.11.123+, Camera Station Pro 6.20+, Camera Station 5.59 SR2+, File Player 3.1.10.0+, Secure Entry 12.11.106.1+, Signed Media Verifier 1.0.3+, and Signed-Video-Framework 2.3.7+.

Given the breadth of affected products (physical security and surveillance infrastructure) and the potential for remote code execution, organizations using Axis equipment—common in critical infrastructure, retail, transportation, and government facilities—should prioritize patching per the vendor's severity ratings for each individual CVE.

## Mentioned in this report

- Vulnerabilities: CVE-2026-12389, CVE-2026-12963, CVE-2026-12964, CVE-2026-13312, CVE-2026-13387, CVE-2026-13409, CVE-2026-14542, CVE-2026-14543, CVE-2026-14918, CVE-2026-4762, CVE-2026-63282, CVE-2026-63286, CVE-2026-63287, CVE-2026-63288, CVE-2026-8372, CVE-2026-9063

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1523

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bb6bc6ab-58c0-5d42-b7b2-9c7e98f470b0/cert-fr-flags-multiple-axis-product-vulnerabilities.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup