CVE-2025-30026 is a critical (CVSS 9.8) authentication bypass in the AXIS Camera Station Server, covering AXIS Camera Station and AXIS Camera Station Pro. The record says a flaw allowed bypassing authentication that is normally required. Read the Axis advisory for fixed versions.
What's affected
The record lists AXIS Camera Station and AXIS Camera Station Pro as affected and says the server had a flaw that allowed a bypass of required authentication.
The record gives no version numbers. It links to an Axis advisory PDF. I could download the file but could not read its text, so I cannot confirm affected or fixed versions. Open the advisory and use the versions it gives.
The record does not flag the CVE as known exploited (not in the CISA KEV catalog at the time of writing).
How to check if you're exposed
Camera Station is video management software, usually installed on a Windows server.
- Find the installed version in the application or in the Windows list of installed programs.
- Compare it with the fixed versions in the Axis advisory.
- Check whether the server is reachable from the internet, a guest network or a flat office network.
Review the Camera Station audit log for logins and configuration changes you cannot explain, and check the list of users and API clients.
What to do now
- Open the Axis advisory for CVE-2025-30026 and note affected and fixed versions.
- Update AXIS Camera Station or AXIS Camera Station Pro to the fixed version using Axis's normal update process.
- Keep the server off the public internet. Use a VPN or a segmented network for remote access.
- Review user accounts, API access and recent configuration changes.
- Plan regular updates, since video systems record sensitive footage and sit on internal networks.
Why it matters
The record maps the flaw to CWE-288 (Authentication Bypass Using an Alternate Path or Channel). That means there was a way to reach protected functions without going through the normal login. The record gives no more detail, and I will not guess at the mechanism.
A 9.8 score follows from network reach, no required privileges and high impact. A video management server holds recordings, camera credentials and the ability to view or change camera settings. Compromise could expose private footage and offer a foothold in a security network.
Physical security systems are often installed and then left alone. Treat them like any other server: inventory, patch and restrict access.
Quick check
Which versions are fixed?
Check the Axis advisory linked from the record. I could not read its text, so I will not state versions.
Should the server be reachable from the internet?
Avoid it. Use a VPN or other controlled remote access.
Sources
Last reviewed: 19 October 2026.
