{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14543", "assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "state": "PUBLISHED", "assignerShortName": "Axis", "dateReserved": "2026-07-03T06:01:02.000Z", "datePublished": "2026-11-10T05:20:29.154Z", "dateUpdated": "2026-11-12T17:11:50.904Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "shortName": "Axis", "dateUpdated": "2026-11-10T05:20:29.154Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1287", "description": "CWE-1287: Improper Validation of Specified Type of Input", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource", "type": "CWE"}]}], "affected": [{"vendor": "Axis Communications AB", "product": "AXIS OS", "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.0.42", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThan": "12.11.84", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account."}]}], "references": [{"url": "https://www.axis.com/dam/public/cd/92/6b/cve-2026-14543pdf-en-US-561257.pdf"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 3.9, "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Dave Lester Mondina (kakashi1337) from Genki Tech Labs", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T17:11:36.936658Z", "id": "CVE-2026-14543", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T17:11:50.904Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "AXIS OS", "vendor": "Axis Communications AB", "versions": [{"lessThan": "13.0.42", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "12.11.84", "status": "affected", "version": "12.0.0", "versionType": "semver"}]}], "source": "product-security@axis.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account."}], "id": "CVE-2026-14543", "lastModified": "2026-11-12T19:26:10.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.3, "impactScore": 3.6, "source": "product-security@axis.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14543", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T17:11:36.936658Z", "version": "2.0.3"}}]}, "published": "2026-11-10T06:17:09.093", "references": [{"source": "product-security@axis.com", "url": "https://www.axis.com/dam/public/cd/92/6b/cve-2026-14543pdf-en-US-561257.pdf"}], "sourceIdentifier": "product-security@axis.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}, {"lang": "en", "value": "CWE-1287"}], "source": "product-security@axis.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.42)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.11.84)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AXIS OS", "source": "cna", "vendor": "Axis Communications AB"}, "product": "axis_os", "vendor": "axis_communications_ab"}], "created": "2026-11-15T03:15:05.209248+00:00", "title": "VAPIX Edge Storage API Privilege Escalation via Filesystem Isolation Bypass", "updated": "2026-11-15T08:15:09.183471+00:00", "vendors": ["axis_communications_ab", "axis_communications_ab$PRODUCT$axis_os"]}