Denial of Service Vulnerability in VAPIX API by Axis Communications
CVE-2026-13409

4.3MEDIUM

Key Information:

Vendor

Axis Communications Ab

Status
Axis Os
Vendor
CVE Published:
10 November 2026

What is CVE-2026-13409?

The VAPIX API's dynamic overlay functionality is susceptible to a Denial-of-Service condition when exploited by an authenticated user with operator or admin privileges. This vulnerability could disrupt the intended operations of the overlay feature, affecting the overall functionality and user experience. Proper authentication is required before this flaw can be exploited, limiting potential attackers to those with legitimate access. It is essential for users of affected versions to remain vigilant and consider applying any recommended security updates or patches provided by Axis Communications.

Affected Version(s)

AXIS OS 13.0.0 < 13.0.31

AXIS OS 12.0.0 < 12.11.84

AXIS OS 11.0.0 < 11.11.218

References

https://www.axis.com/dam/public/ef/b3/81/cve-2026-13409pd...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang
.