CVE-2026-6505

Name of the Vulnerable Software and Affected Versions Axis ACAP framework (affected versions not specified)

Description The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which is a software bug where a system checks the state of a resource before using it, but the state changes between the check and the use. This issue could potentially lead to privilege escalation. Exploitation requires the Axis device to be configured to allow the installation of unsigned ACAP applications and for an attacker to convince the victim to install a malicious ACAP application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the installation of unsigned ACAP applications to minimize the risk of exploitation.