Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Axis Communications bug bounty programs

axis.com Updated

Axis Communications runs one public program: a Bugcrowd bug bounty paying up to $50,000.

Top reward
$50,000
Bugcrowd
Programs
1
1 pays cash
Targets in scope
1
1 type
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Axis Communications runs.

  • AXIS OS

    Bugcrowd · Bug bounty

    Open

    Top reward

    $50k
    Critical
    $40k
    High
    $10k
    Medium
    $2,000
    Low
    $500
    Safe harbor
    Full

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

1 target.

  • AXIS OS

    Hardware and IoT

No target matches. Try part of a host name, such as the company name.

Recent changes

Reward and scope changes across every Axis Communications program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Axis Communications products, from the NVD.

Search NVD
  • CVE-2026-0804 Medium

    An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

  • CVE-2026-1185 Medium

    A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH.

  • CVE-2026-0541 Medium

    ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

  • CVE-2026-0802 Medium

    An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

  • CVE-2025-12063 Medium

    An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.

  • CVE-2025-11547 High

    AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.

  • CVE-2025-12757 Medium

    An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to.

  • CVE-2025-13064 Medium

    A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a client that have been tampered with.

About this page

This page gathers every public program listed under axis.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.