Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5795 across Splunk SPL, Microsoft KQL and Sigma, covering 3 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: AXIS Camera Station Server Spawning Suspicious Child Process (CVE-2026-12389 / CVE-2026-13312)

Detects shells and living-off-the-land binaries launched by AXIS Camera Station Pro/5 server processes. Insecure deserialization (CVE-2026-12389, CWE-502) and the critical CVE-2026-13312 flaw (TL-2026-5795) are expected to surface as unexpected child processes of the server service. Process and path names are inferred from the default Axis install path; no public PoC or in-the-wild exploitation is reported.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1210, T1059
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    (ParentImage="*\\Axis Communications\\*" OR ParentImage="*AXIS Camera Station*")
    Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\pwsh.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe", "*\\rundll32.exe", "*\\regsvr32.exe", "*\\certutil.exe", "*\\bitsadmin.exe", "*\\curl.exe", "*\\whoami.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(Image) as child_images by host, ParentImage, User
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFolderPath has "Axis Communications" or InitiatingProcessFolderPath has "AXIS Camera Station"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "whoami.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: AXIS Camera Station Server Spawning Suspicious Child Process
id: 7c1d5a52-3e0b-4b7e-9a41-5f6b2a8d1c01
status: experimental
description: Detects shells and LOLBins launched by AXIS Camera Station server processes, a post-exploitation indicator for deserialization RCE (CVE-2026-12389) or the critical CVE-2026-13312 flaw (TL-2026-5795). No public PoC or in-the-wild exploitation is reported.
references:
    - https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4465
    - https://help.axis.com/en-us/security-advisories
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.lateral-movement
    - attack.t1210
    - attack.execution
    - attack.t1059
    - cve.2026.12389
    - cve.2026.13312
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains:
            - '\Axis Communications\'
            - 'AXIS Camera Station'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\curl.exe'
            - '\whoami.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Vendor installers, diagnostics or support scripts launched by the Camera Station service
    - Administrator maintenance via a Camera Station helper tool
level: high

Known false positives:

• Vendor installers, diagnostics or support scripts launched by the Camera Station service
• Administrator maintenance through Camera Station helper tools

Tuning notes: Confirm the real server and service binary names on a patched test host and tighten ParentImage to them. Baseline 14 days of child processes and allowlist known-good CommandLine values. Scope to the Camera Station hosts via an asset lookup.

• 🔒 AXIS Camera Station Deserialization Errors (CVE-2026-12389) · unlock with TL Creds
• 🔒 AXIS Camera Station Audit Log Tampering by Non-Axis Process (CVE-2026-63287) · unlock with TL Creds
• 🔒 AXIS Camera Station Database Backup Staging (CVE-2026-63286) · unlock with TL Creds
• 🔒 Open Redirect Abuse in Camera Station Sign-Out Flow (CVE-2026-13387) · unlock with TL Creds
• 🔒 AXIS Camera Station Service Crash Burst · unlock with TL Creds
• 🔒 Many-Source Network Logons to Camera Station Hosts (CVE-2026-8372 / CVE-2026-12964) · unlock with TL Creds
• 🔒 Privileged Group Membership Change on Camera Station Server (CVE-2026-12964 / CVE-2026-4762) · unlock with TL Creds
• 🔒 AXIS Camera Station Server Outbound Connection to Public Address · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 3 indicators of compromise for TL-2026-5795.

Technical analysis

Neither exploitation in the wild nor a public PoC is stated in the sources.

On 2026-11-10 Axis Communications disclosed a batch of vulnerabilities in AXIS Camera Station Pro (6.x) and AXIS Camera Station 5, and BSI CERT-Bund republished them as WID-SEC-W-2026-4465 (TLP:WHITE, aggregate severity 'hoch'). The affected product is video surveillance management software running on Windows that records and manages network camera streams.

The highest-rated issue is CVE-2026-13312 (CVSS 3.1 9.9 Critical, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-1287 Improper Validation of Specified Type of Input). The public description is only 'a vulnerability that could allow an attacker to compromise a system'; affected are Camera Station Pro 6.0 to before 6.17 and Camera Station 5.0 to before 5.59 SR2. The Axis advisory page listed the entry as 'TBA' pending the 10 November 2026 disclosure, and full technical details were not retrievable from the sources reviewed.

Other issues in the set: CVE-2026-12389 (8.4, CWE-502 deserialization of untrusted data) lets a high-privileged authenticated user on an adjacent network achieve remote code execution; CVE-2026-12964 (8.0, adjacent network, CWE-918) lets a Viewer account escalate to administrator; CVE-2026-4762 (8.8, local, CWE-347 improper verification of cryptographic signature) lets a non-admin user escalate privileges on the server; CVE-2026-8372 (8.8, network, user interaction required, CWE-306 missing authentication for critical function) allows unauthorized access; CVE-2026-12963 (7.4, CWE-732 incorrect permission assignment) lets a Viewer account gain unauthorized access to network-attached storage devices on the server; CVE-2026-63287 (6.5, CWE-117/CWE-863) lets a non-admin user modify data objects without permission, enabling tampering with audit log creation; CVE-2026-63286 (7.1, CWE-326 inadequate encryption strength) makes database backups, including those made before patching, vulnerable to offline attacks; and CVE-2026-13387 (3.5, CWE-601) is an open redirect in the sign-out flow usable for phishing.

Fixed releases named in the advisory are Camera Station Pro 6.17, 6.18 and 6.20 and Camera Station 5.59 / SR 2, depending on the CVE. For CVE-2026-63286, defenders must additionally delete pre-patch database backups and change stored credentials. CISA-ADP SSVC for CVE-2026-63286 (2026-11-05) records Exploitation: none, Automatable: no, Technical Impact: total. No source states active exploitation or public PoC code for any of the nine CVEs. Several CVE-to-CWE mappings look inconsistent (for example CVE-2026-12964 described as privilege escalation but mapped to SSRF CWE-918) and should be confirmed with the vendor. This record has no network IOCs; BeaconBeagle correlation was not applicable.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Persistence

T1078 Valid Accounts

Initial Access

T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link

Impact

T1499.004 Application or System Exploitation; T1565.001 Stored Data Manipulation

Remediation

Patches

• AXIS Camera Station Pro 6.17, 6.18 and 6.20
• AXIS Camera Station 5.59 and SR 2

Immediate actions

• Upgrade AXIS Camera Station Pro to 6.20 (or at minimum the fixed release named per CVE: 6.17 or 6.18) and AXIS Camera Station 5 to 5.59 SR 2
• Delete database backups created before patching and change all credentials stored in Camera Station (CVE-2026-63286)
• Review Viewer, Operator and non-admin accounts and remove any that are unnecessary
• Audit Camera Station audit logs for unexpected or malformed entries and privilege changes

Workarounds

• Restrict network access to the Camera Station server to trusted management hosts only
• Limit interactive and remote logon rights on the Camera Station server

Longer-term hardening

• Place Camera Station servers and cameras on a segmented management VLAN; several CVEs require adjacent-network or local access
• Follow the Axis system hardening guide for backup protection and least-privilege accounts
• Subscribe to Axis security notifications and the BSI/CERT-Bund WID feed

Affected and fixed versions

• Axis Communications — AXIS Camera Station Pro
  Vulnerable versions: 6.0 to before 6.17 (CVE-2026-13312); 6.0 to before 6.18 (CVE-2026-12389, CVE-2026-12963, CVE-2026-63287, CVE-2026-13387); 6.1 to before 6.18 (CVE-2026-4762); 6.6 to before 6.18 (CVE-2026-12964); 6.13 to before 6.18 (CVE-2026-8372); 6.0 to before 6.20 (CVE-2026-63286)
  Fixed in: 6.17; 6.18; 6.20
• Axis Communications — AXIS Camera Station 5
  Vulnerable versions: 5.0 to before 5.59 (CVE-2026-12389, CVE-2026-12963, CVE-2026-63287); 5.0 to before 5.59 SR2 (CVE-2026-13312); 5.00 and later (CVE-2026-63286, per CVE record)
  Fixed in: 5.59; 5.59 SR 2

Timeline

• 2026-03-24 CVE-2026-4762 (non-admin to server privilege escalation) reserved, the earliest reservation in the set
• 2026-06-25 CVE-2026-13312 (CVSS 9.9, CWE-1287) reserved; other CVEs in the batch reserved between 2026-05-12 and 2026-07-16
• 2026-10-28 CVE-2026-63286 (database backups vulnerable to offline attack) published; fixed in Camera Station Pro 6.20
• 2026-11-05 CISA-ADP SSVC for CVE-2026-63286: Exploitation none, Automatable no, Technical Impact total
• 2026-11-10 BSI CERT-Bund publishes WID-SEC-W-2026-4465 (TLP:WHITE, severity high) covering all nine CVEs
• 2026-11-10 Axis publishes advisories for CVE-2026-13312, 12389, 12964, 12963, 8372, 4762, 63287 and 13387 with fixed releases Pro 6.17/6.18 and Camera Station 5.59 SR 2

Sources cited

• GCVE mirror of BSI advisory WID-SEC-W-2026-4465 db.gcve.eu · Advisory · 2026-11-10
• BSI CERT-Bund WID advisory WID-SEC-2026-4465 wid.cert-bund.de · Advisory · 2026-11-10
• BSI CSAF document wid-sec-w-2026-4465 wid.cert-bund.de · Advisory · 2026-11-10
• NVD CVE-2026-13312 NVD (NIST) · Advisory · 2026-11-10
• Axis security advisories help.axis.com · Vendor report · 2026-11-10
• Axis advisory CVE-2026-13312 axis.com · Vendor report · 2026-11-10
• Axis advisory CVE-2026-12964 axis.com · Vendor report · 2026-11-10
• Axis advisory CVE-2026-12389 axis.com · Vendor report · 2026-11-10
• Axis advisory CVE-2026-63286 axis.com · Vendor report · 2026-10-28
• Axis advisory CVE-2026-63287 axis.com · Vendor report · 2026-11-10
• Axis advisory CVE-2026-12963 axis.com · Vendor report · 2026-11-10
• Axis advisory CVE-2026-8372 axis.com · Vendor report · 2026-11-10
• Axis advisory CVE-2026-4762 axis.com · Vendor report · 2026-11-10
• Axis advisory CVE-2026-13387 axis.com · Vendor report · 2026-11-10

More in vulnerability

• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches