CVE-2026-6505CWE-367

CVE-2026-6505

Medium · published August 11, 2026

CVSS v3.1
5.1
EPSS
0%
Percentile
0.6
In the wild
Unconfirmed
What it is

The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00094 · 0.6th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-08-11T10:17Z
References (1)
https://www.axis.com/dam/public/fd/16/ab/cve-2026-6505pdf-en-US-543641.pdf · [email protected]
EPSS history
Timeline
  • 11 AUG 05:49Z
    The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation
    cvelistv5