{"metadata": {"vulnerability": "CVE-2026-63286", "count": 22, "kinds": {"milestone": 5, "sighting": 7, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-07-16T08:28:41.293Z", "date_only": false, "value": "2026-07-16T08:28:41.293Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-63286", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1408", "record": "CERTFR-2026-AVI-1408", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": true, "value": "2026-10-28", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1408", "record": "CERTFR-2026-AVI-1408", "field": "initial_release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1408", "record": "CERTFR-2026-AVI-1408", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-10-28T06:54:23.362Z", "date_only": false, "value": "2026-10-28T06:54:23.362Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-63286", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T06:54:23.362Z", "date_only": false, "value": "2026-10-28T06:54:23.362Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Axis", "record": "CVE-2026-63286", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-28T07:16:48Z", "date_only": false, "value": "2026-10-28T07:16:48Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7C4C-2F85-QF36", "record": "GHSA-7C4C-2F85-QF36", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T07:16:48.550Z", "date_only": false, "value": "2026-10-28T07:16:48.550", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63286", "record": "FKIE_CVE-2026-63286", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T07:50:00.683Z", "date_only": false, "value": "2026-10-28T07:50:00.683852Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117517438159860306", "record": "CVE-2026-63286", "field": "creation_timestamp", "uuid": "41259bc1-974a-411a-8213-48647237fe1d", "content": "CVE-2026-63286  Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the credentials stored in AXIS Camera Station Pro.\nhttps://www.cve.org/CVERecord?id=CVE-2026-63286https://www.axis.com/dam/public/c9/5c/29/cve-2026-63286pdf-en-US-560650.pdf#axis #AxisCommunicationsAB #AXISCameraStationPro #AXISCameraStation5#CVE_2026_63286#bot", "url": "https://infosec.exchange/users/cve/statuses/117517438159860306"}, {"timestamp": "2026-10-28T09:31:55Z", "date_only": false, "value": "2026-10-28T09:31:55Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7C4C-2F85-QF36", "record": "GHSA-7C4C-2F85-QF36", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T09:31:55Z", "date_only": false, "value": "2026-10-28T09:31:55Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7C4C-2F85-QF36", "record": "GHSA-7C4C-2F85-QF36", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-28T19:00:08Z", "date_only": false, "value": "2026-10-28T19:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/107817", "record": "CVE-2026-63286", "field": "creation_timestamp", "uuid": "9981218f-6142-42d5-8738-66f05c7b3034", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63286\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ricardojoserf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-28 18:49:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-63286: Offline decryptor for AXIS Camera Station (ACS) credentials\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107817", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-28T19:00:08Z", "date_only": false, "value": "2026-10-28T19:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/107817", "record": "CVE-2026-63286", "field": "creation_timestamp", "uuid": "37f3e5f3-a1b8-4b5b-9ddb-d4ec359a829e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63286\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ricardojoserf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-28 18:49:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-63286: Offline decryptor for AXIS Camera Station (ACS) credentials\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107817"}, {"timestamp": "2026-10-29T09:03:27.714Z", "date_only": false, "value": "2026-10-29T09:03:27.714794Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3myyvtxkfzq2q", "record": "CVE-2026-63286", "field": "creation_timestamp", "uuid": "34ebe199-7b68-4d1a-bf35-7d6875d50aac", "content": "Axis Camera Station Deep-Dive: Unauth RCE to Decrypting Every Camera Credential (CVE-2025-30026/30023 + CVE-2026-63286)", "url": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3myyvtxkfzq2q"}, {"timestamp": "2026-10-29T09:39:31.718Z", "date_only": false, "value": "2026-10-29T09:39:31.718822Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3myyxuhn3pp2b", "record": "CVE-2026-63286", "field": "creation_timestamp", "uuid": "809cbced-d4e8-4585-9a63-9ffbb76a4da0", "content": "Axis Camera Station Deep-Dive: Unauth RCE to Decrypting Every Camera Credential (CVE-2025-30026/30023 + CVE-2026-63286)", "url": "https://bsky.app/profile/r-netsec.bsky.social/post/3myyxuhn3pp2b"}, {"timestamp": "2026-10-29T10:12:34Z", "date_only": false, "value": "2026-10-29T10:12:34.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/P0x3k_1N73LL1G3NC3/454", "record": "CVE-2026-63286", "field": "creation_timestamp", "uuid": "fb6dba13-b288-401e-a3f5-784567aa5d93", "content": "\ud83d\udcdc From RCE to camera credentials in Axis Camera Station\n\nDuring a penetration test, I exploited CVE-2025-30023 (insecure deserialization) chained with CVE-2025-30026 (authentication bypass) to get SYSTEM-level RCE on two Windows machines running Axis Camera Station on a factory. After that, I discovered CVE-2026-63286, a weak credential encryption scheme, which allowed me to decrypt all the camera credentials stored in the application\u2019s database and connect to the cameras.\n\nFull attack chain summary:\n   \u2022 Identify Axis Camera Station on port 55752 during the network scan.\n   \u2022 Exploit CVE-2025-30026 + CVE-2025-30023 to get unauthenticated RCE as SYSTEM on both Windows servers, getting access to the factory network.\n   \u2022 Copy the .FDB database files.\n   \u2022 Exploit CVE-2026-63286 to decrypt all stored credentials.\n   \u2022 Connect to the factory cameras using the decrypted credentials.\n\n \ud83d\udd17Axis-RCE\n\nUnauth RCE on Axis Camera Station (ACS)\n\n \ud83d\udd17CVE-2026-63286\n\nOffline decryptor for AXIS Camera Station (ACS) credentials", "url": "https://t.me/P0x3k_1N73LL1G3NC3/454", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-03T01:05:40.669Z", "date_only": false, "value": "2026-11-03T01:05:40.669320Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mzeni7ntua2f", "record": "CVE-2026-63286", "field": "creation_timestamp", "uuid": "34203f2b-dc4a-488b-ba4a-4e0a5c319a45", "content": "Details and an Axis Camera Station RCE PoC are public. Patch CVE-2025-30026, CVE-2025-30023, and CVE-2026-63286 to prevent camera credential theft.\n\n#AxisCommunications #AxisCameraStation #RCE #PoC #CVE202530026 #CVE202663286 #Cybersecurity #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mzeni7ntua2f"}, {"timestamp": "2026-11-05T17:01:57.115Z", "date_only": false, "value": "2026-11-05T17:01:57.115676Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63286", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-05T17:01:57.115Z", "date_only": false, "value": "2026-11-05T17:01:57.115676Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63286", "record": "FKIE_CVE-2026-63286", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-05T17:04:11.782Z", "date_only": false, "value": "2026-11-05T17:04:11.782Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-63286", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-05T17:04:11.782Z", "date_only": false, "value": "2026-11-05T17:04:11.782Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63286", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T17:18:20.180Z", "date_only": false, "value": "2026-11-05T17:18:20.180", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63286", "record": "FKIE_CVE-2026-63286", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-07T17:41:33.696Z", "anchors": {"origin": {"timestamp": "2026-10-28T00:00:00Z", "date_only": true, "value": "2026-10-28", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1408", "record": "CERTFR-2026-AVI-1408", "field": "initial_release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T00:00:00Z", "date_only": true, "value": "2026-10-28", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1408", "record": "CERTFR-2026-AVI-1408", "field": "initial_release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-28T19:00:08Z", "date_only": false, "value": "2026-10-28T19:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/107817", "record": "CVE-2026-63286", "field": "creation_timestamp", "uuid": "9981218f-6142-42d5-8738-66f05c7b3034", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63286\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ricardojoserf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-28 18:49:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-63286: Offline decryptor for AXIS Camera Station (ACS) credentials\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107817", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 68408.0, "hours": 19.002222222222223, "days": 0.7917592592592593, "min_seconds": -17992.0, "max_seconds": 68408.0, "approximate": true, "ongoing": false, "order_known": false, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:00:00Z", "date_only": true, "value": "2026-10-28", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1408", "record": "CERTFR-2026-AVI-1408", "field": "initial_release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-28T19:00:08Z", "date_only": false, "value": "2026-10-28T19:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/107817", "record": "CVE-2026-63286", "field": "creation_timestamp", "uuid": "9981218f-6142-42d5-8738-66f05c7b3034", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63286\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ricardojoserf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-28 18:49:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-63286: Offline decryptor for AXIS Camera Station (ACS) credentials\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107817", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 927693.696312, "hours": 257.69269342, "days": 10.737195559166667, "min_seconds": 841293.696312, "max_seconds": 927693.696312, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:00:00Z", "date_only": true, "value": "2026-10-28", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1408", "record": "CERTFR-2026-AVI-1408", "field": "initial_release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-07T17:41:33.696Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 859285.696312, "hours": 238.69047119777778, "days": 9.945436299907408, "min_seconds": 859285.696312, "max_seconds": 859285.696312, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T19:00:08Z", "date_only": false, "value": "2026-10-28T19:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/107817", "record": "CVE-2026-63286", "field": "creation_timestamp", "uuid": "9981218f-6142-42d5-8738-66f05c7b3034", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63286\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ricardojoserf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-28 18:49:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-63286: Offline decryptor for AXIS Camera Station (ACS) credentials\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107817", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-07T17:41:33.696Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}