Avigilon develops access control and video surveillance management platforms, with a focused product portfolio centered on its Access Control Manager and Avigilon Control Center systems. The observed vulnerability patterns reflect the web and data-handling attack surface of these management applications, recurring through output-encoding weaknesses, path-traversal flaws, CSV-injection issues, and HTTP-request smuggling—typical of multi-user management interfaces exposed to network clients. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Avigilon over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-56266CRITICAL A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL. | Sep 8, 2025 | 9.8 | 43 | NO | YES |
CVE-2025-56267CRITICAL A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file. | Sep 8, 2025 | 9.8 | 31 | NO | NO |
CVE-2015-2860HIGH Directory traversal vulnerability in Avigilon Control Center (ACC) 4 before 4.12.0.54 and 5 before 5.4.2.22 allows remote attackers to read arbitrary files via a crafted help/ URL. | Jun 23, 2015 | 7.8 | 20 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Avigilon.
Media articles that mention a CVE ID that affects a product developed by Avigilon — matched by CVE ID, not by vendor name.