# Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)

> BSI/CERT-Bund advisory WID-SEC-W-2026-4465 (rated high, published 2026-11-10) covers nine vulnerabilities in Axis Camera Station Pro 6.x and Camera Station 5.x, the Windows video management software for Axis network cameras. Per the advisory, an attacker could bypass security controls, escalate privileges to administrator, execute arbitrary code, or manipulate and disclose data, potentially leading to full system compromise. Neither exploitation in the wild nor a public PoC is stated in the sources.

- **Published:** 2026-11-11T20:58:13Z
- **Last reviewed:** 2026-11-11T20:58:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5795
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5795.png
- **ID:** TL-2026-5795
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 3
- **CVEs:** CVE-2026-13312, CVE-2026-12389, CVE-2026-12964, CVE-2026-4762, CVE-2026-8372, CVE-2026-12963, CVE-2026-63286, CVE-2026-63287, CVE-2026-13387

## Description

On 2026-11-10 Axis Communications disclosed a batch of vulnerabilities in AXIS Camera Station Pro (6.x) and AXIS Camera Station 5, and BSI CERT-Bund republished them as WID-SEC-W-2026-4465 (TLP:WHITE, aggregate severity 'hoch'). The affected product is video surveillance management software running on Windows that records and manages network camera streams.

The highest-rated issue is CVE-2026-13312 (CVSS 3.1 9.9 Critical, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-1287 Improper Validation of Specified Type of Input). The public description is only 'a vulnerability that could allow an attacker to compromise a system'; affected are Camera Station Pro 6.0 to before 6.17 and Camera Station 5.0 to before 5.59 SR2. The Axis advisory page listed the entry as 'TBA' pending the 10 November 2026 disclosure, and full technical details were not retrievable from the sources reviewed.

Other issues in the set: CVE-2026-12389 (8.4, CWE-502 deserialization of untrusted data) lets a high-privileged authenticated user on an adjacent network achieve remote code execution; CVE-2026-12964 (8.0, adjacent network, CWE-918) lets a Viewer account escalate to administrator; CVE-2026-4762 (8.8, local, CWE-347 improper verification of cryptographic signature) lets a non-admin user escalate privileges on the server; CVE-2026-8372 (8.8, network, user interaction required, CWE-306 missing authentication for critical function) allows unauthorized access; CVE-2026-12963 (7.4, CWE-732 incorrect permission assignment) lets a Viewer account gain unauthorized access to network-attached storage devices on the server; CVE-2026-63287 (6.5, CWE-117/CWE-863) lets a non-admin user modify data objects without permission, enabling tampering with audit log creation; CVE-2026-63286 (7.1, CWE-326 inadequate encryption strength) makes database backups, including those made before patching, vulnerable to offline attacks; and CVE-2026-13387 (3.5, CWE-601) is an open redirect in the sign-out flow usable for phishing.

Fixed releases named in the advisory are Camera Station Pro 6.17, 6.18 and 6.20 and Camera Station 5.59 / SR 2, depending on the CVE. For CVE-2026-63286, defenders must additionally delete pre-patch database backups and change stored credentials. CISA-ADP SSVC for CVE-2026-63286 (2026-11-05) records Exploitation: none, Automatable: no, Technical Impact: total. No source states active exploitation or public PoC code for any of the nine CVEs. Several CVE-to-CWE mappings look inconsistent (for example CVE-2026-12964 described as privilege escalation but mapped to SSRF CWE-918) and should be confirmed with the vendor. This record has no network IOCs; BeaconBeagle correlation was not applicable.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.002 Spearphishing Link
- T1078 Valid Accounts
- T1005 Data from Local System
- T1565.001 Stored Data Manipulation
- T1499.004 Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**AXIS Camera Station Server Spawning Suspicious Child Process (CVE-2026-12389 / CVE-2026-13312)** (`TL-2026-5795-SPL-001`)

Detects shells and living-off-the-land binaries launched by AXIS Camera Station Pro/5 server processes. Insecure deserialization (CVE-2026-12389, CWE-502) and the critical CVE-2026-13312 flaw (TL-2026-5795) are expected to surface as unexpected child processes of the server service. Process and path names are inferred from the default Axis install path; no public PoC or in-the-wild exploitation is reported.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1210, T1059
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    (ParentImage="*\\Axis Communications\\*" OR ParentImage="*AXIS Camera Station*")
    Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\pwsh.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe", "*\\rundll32.exe", "*\\regsvr32.exe", "*\\certutil.exe", "*\\bitsadmin.exe", "*\\curl.exe", "*\\whoami.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(Image) as child_images by host, ParentImage, User
| convert ctime(first_seen) ctime(last_seen)
| sort - count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFolderPath has "Axis Communications" or InitiatingProcessFolderPath has "AXIS Camera Station"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "whoami.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: AXIS Camera Station Server Spawning Suspicious Child Process
id: 7c1d5a52-3e0b-4b7e-9a41-5f6b2a8d1c01
status: experimental
description: Detects shells and LOLBins launched by AXIS Camera Station server processes, a post-exploitation indicator for deserialization RCE (CVE-2026-12389) or the critical CVE-2026-13312 flaw (TL-2026-5795). No public PoC or in-the-wild exploitation is reported.
references:
    - https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4465
    - https://help.axis.com/en-us/security-advisories
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.lateral-movement
    - attack.t1210
    - attack.execution
    - attack.t1059
    - cve.2026.12389
    - cve.2026.13312
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains:
            - '\Axis Communications\'
            - 'AXIS Camera Station'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\curl.exe'
            - '\whoami.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Vendor installers, diagnostics or support scripts launched by the Camera Station service
    - Administrator maintenance via a Camera Station helper tool
level: high

```

**Known false positives:**

- Vendor installers, diagnostics or support scripts launched by the Camera Station service
- Administrator maintenance through Camera Station helper tools

**Tuning notes:** Confirm the real server and service binary names on a patched test host and tighten ParentImage to them. Baseline 14 days of child processes and allowlist known-good CommandLine values. Scope to the Camera Station hosts via an asset lookup.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AXIS Camera Station Deserialization Errors (CVE-2026-12389) (locked: unlock with TL Creds)
- AXIS Camera Station Audit Log Tampering by Non-Axis Process (CVE-2026-63287) (locked: unlock with TL Creds)
- AXIS Camera Station Database Backup Staging (CVE-2026-63286) (locked: unlock with TL Creds)
- Open Redirect Abuse in Camera Station Sign-Out Flow (CVE-2026-13387) (locked: unlock with TL Creds)
- AXIS Camera Station Service Crash Burst (locked: unlock with TL Creds)
- Many-Source Network Logons to Camera Station Hosts (CVE-2026-8372 / CVE-2026-12964) (locked: unlock with TL Creds)
- Privileged Group Membership Change on Camera Station Server (CVE-2026-12964 / CVE-2026-4762) (locked: unlock with TL Creds)
- AXIS Camera Station Server Outbound Connection to Public Address (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [GCVE mirror of BSI advisory WID-SEC-W-2026-4465](https://db.gcve.eu/vuln/wid-sec-w-2026-4465)
- [BSI CERT-Bund WID advisory WID-SEC-2026-4465](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4465)
- [BSI CSAF document wid-sec-w-2026-4465](https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4465.json)
- [Axis security advisories](https://help.axis.com/en-us/security-advisories)
- [Axis advisory CVE-2026-13312](https://www.axis.com/dam/public/e4/2d/85/cve-2026-13312pdf-en-US-561251.pdf)
- [Axis advisory CVE-2026-12964](https://www.axis.com/dam/public/50/3b/39/cve-2026-12964pdf-en-US-561250.pdf)
- [Axis advisory CVE-2026-12389](https://www.axis.com/dam/public/1a/bd/41/cve-2026-12389pdf-en-US-561248.pdf)
- [Axis advisory CVE-2026-63286](https://www.axis.com/dam/public/c9/5c/29/cve-2026-63286pdf-en-US-560650.pdf)
- [Axis advisory CVE-2026-63287](https://www.axis.com/dam/public/bc/65/61/cve-2026-63287pdf-en-US-561253.pdf)
- [Axis advisory CVE-2026-12963](https://www.axis.com/dam/public/c5/ba/15/cve-2026-12963pdf-en-US-561249.pdf)
- [Axis advisory CVE-2026-8372](https://www.axis.com/dam/public/09/58/fa/cve-2026-8372pdf-en-US-561247.pdf)
- [Axis advisory CVE-2026-4762](https://www.axis.com/dam/public/1f/4b/66/cve-2026-4762pdf-en-US-561246.pdf)
- [Axis advisory CVE-2026-13387](https://www.axis.com/dam/public/d7/64/a2/cve-2026-13387pdf-en-US-561252.pdf)
- [NVD CVE-2026-13312](https://nvd.nist.gov/vuln/detail/CVE-2026-13312)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5795