CVE-2026-5303

13th percentile - higher than 13% of all known CVEs

The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow installation of unsigned ACAP applications and if an attacker convinces the victim to install a malicious ACAP application.

Privilege escalation could allow an attacker to gain higher privileges on the device, potentially leading to full system compromise.

Update the ACAP framework to a patched version and consider disabling installation of unsigned ACAP applications on Axis devices.