The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access…

published 2026-11-10 2d ago modified 2026-11-10 2d ago also EUVD-2026-120772

cvss: 3.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits: 0; none known

The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.

Patch / fix

fixed in 1

Axis Communications AB AXIS OS 12.11.84, 13.0.42

Is CVE-2026-14543 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by	version	score	vector
CNA	3.1	3.9	CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

Axis Communications AB AXIS OS

Classification

Weakness

CWE-1287 Improper Validation of Specified Type of Input
CWE-732 Incorrect Permission Assignment for Critical Resource

References

axis.com /dam/public/cd/92/6b/cve-2026-14543pdf-en-US-561257.pdf

Sources

CVE List CVE-2026-14543
NVD CVE-2026-14543

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.