CVE-2025-11142: Axis OS

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.

Affected products

• Axis Axis OS: from 12.6.54, before 12.7.36 (fixed in 12.7.36)

Published 2026-02-10. Last modified 2026-06-17.