Axis Communications has disclosed a critical security flaw in its Camera Station video management software, scoring 9.9 out of 10 on the severity scale. The flaw, tracked as CVE-2026-13312, was published on Tuesday 10 November 2026, and Axis says it could allow an attacker to compromise a system running the software.

AXIS Camera Station is the software many businesses, schools and public bodies use to view and manage feeds from Axis network cameras. A flaw at this severity in the management server is serious because the server sits at the centre of a surveillance network, with access to live video, recordings and the cameras themselves.

What we know about CVE-2026-13312

Axis lists the flaw as a critical weakness in its AXIS Camera Station products, with a CVSS score of 9.9. The underlying weakness is classified as CWE-1287, improper validation of a specified type of input, which means the software does not properly check the kind of data it is given. In plain terms, a remote attacker could send crafted input that the software mishandles, opening the way to taking over the system.

Full technical details have not yet been released. Axis notes in its advisory that the flaw will be externally disclosed on 10 November 2026 and that more detailed information will follow. No public exploit code has been confirmed so far, and the flaw is not recorded in the US CISA Known Exploited Vulnerabilities catalogue as being actively exploited.

Which versions are affected

According to vulnerability databases, AXIS Camera Station Pro versions before 6.17 and AXIS Camera Station 5 versions before 5.59 SR2 are affected. Axis itself lists the fixed release as still to be announced in its advisory, so administrators should watch the vendor's security registry for the confirmed patch and apply it as soon as it is published.

Axis disclosed several other Camera Station flaws on the same day, including CVE-2026-13387, CVE-2026-12964, CVE-2026-12963, CVE-2026-12389, CVE-2026-8372 and CVE-2026-4762, with scores ranging from low to high. CVE-2026-13312 is the most severe of the group by a wide margin.

What users should do now

Anyone running AXIS Camera Station should check which version is installed and plan to update to the fixed release as soon as Axis confirms it. Until then, standard precautions apply: keep the management server off the public internet, restrict access to trusted networks and administrators only, and make sure only authorised accounts can reach the system.

Surveillance systems are an attractive target because they often run for years without updates and sit on the same networks as other business systems. A flaw scored 9.9 in widely used camera management software is exactly the kind of issue that should be patched quickly, before attackers work out how to exploit it.