Published: August 26, 2026

Version: 1.0

Revision: 1.0

A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device.

Affected Products:

EdgeMAX EdgeSwitch (Version 1.12.1 and earlier)

Mitigation:

Update your EdgeMAX EdgeSwitch to Version 1.12.2 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.6 Critical

Vector: 

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-77532 (Will Robertson)

Reference Links:

https://uisp.community.ui.com/releases/EdgeMAX-EdgeSwitch-1-12-2/d4a7218e-cd00-4df9-b838-1875ea33f3a6

Security Advisory Bulletin 067

Published: August 26, 2026

Version: 1.0

Revision: 1.0

Summary 1 of 22

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

Affected Products:

UniFi Protect Application (Version 7.1.87 and earlier)

Mitigation:

Update your UniFi Protect Application to Version 7.2.105 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77533 (Abdulaziz Almadhi | Catchify Security)

Summary 2 of 22

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Affected Products:

UniFi OS Server (Version 5.1.21 and earlier)

Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall and Express 7 (Version 5.1.26 and earlier)

Mitigation:

Update your UniFi OS Server to Version 5.1.37 or later.

Update your Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall and Express 7 to Version 5.1.31 or later.

Update your Network Attached Storage to Version 5.1.32 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77534 (Abdulaziz Almadhi | Catchify Security)

Summary 3 of 22

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device.

Affected Products:

UniFi Network Application (Version 10.4.57 and earlier)

Mitigation:

Update your UniFi Network Application to Version 10.5.67 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.1 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77535 (Mohammad Seet)

Summary 4 of 22

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Affected Products:

UniFi OS Server (Version 5.1.21 and earlier)

Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall and Express 7 (Version 5.1.26 and earlier)

Mitigation:

Update your UniFi OS Server to Version 5.1.37 or later.

Update your Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall and Express 7 to Version 5.1.31 or later.

Update your Network Attached Storage to Version 5.1.32 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77536 (bugbunny.ai)

Summary 5 of 22

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

Affected Products:

UniFi Protect Application (Version 7.1.87 and earlier)

Mitigation:

Update your UniFi Protect Application to Version 7.2.105 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 10.0 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77537 (bugbunny.ai)

Summary 6 of 22

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to escalate privileges within the UniFi Connect Application.

Affected Products:

UniFi Connect Application (Version 3.24.20 and earlier)

Mitigation:

Update your UniFi Connect Application to Version 3.24.22 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 8.2 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

CVE: CVE-2026-77538 (Andrii Timofeev)

Note: This CVE can be chained with other dependency vulnerabilities to escalate privileges on the host device.

Summary 7 of 22

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

Affected Products:

UniFi OS Server (Version 5.1.21 and earlier)

Mitigation:

Update your UniFi OS Server to Version 5.1.37 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.1 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77539 (Yasser Bensellam)

Summary 8 of 22

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

Affected Products:

UniFi OS Server (Version 5.1.21 and earlier)

Mitigation:

Update your UniFi OS Server to Version 5.1.37 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.1 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77540 (xzyhellsing (Saidina Hikam))

Summary 9 of 22

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.

Affected Products:

UniFi Network Application (Version 10.4.57 and earlier)

Mitigation:

Update your UniFi Network Application to Version 10.5.67 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.1 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77541 (Griffin Francis & Adrian Wood )

Summary 10 of 22

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device.

Affected Products:

UID Enterprise Agent (Version 1.61.8 and earlier)

Mitigation:

Update your UID Enterprise Agent to Version 1.62.1 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.1 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77542 (Ben Koo (@kiddo_pwn))

Summary 11 of 22

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

Affected Products:

UniFi Access Application (Version 4.3.3 and earlier)

Mitigation:

Update your UniFi Access Application to Version 4.3.5 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77543 (Brandon Rossi)

Summary 12 of 22

A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Affected Products:

UniFi OS Server (Version 5.1.21 and earlier)

Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall and Express 7 (Version 5.1.26 and earlier)

Mitigation:

Update your UniFi OS Server to Version 5.1.37 or later.

Update your Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall and Express 7 to Version 5.1.31 or later.

Update your Network Attached Storage to Version 5.1.32 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.0 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CVE: CVE-2026-77545 (arqblasta)

Summary 13 of 22

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

Affected Products:

UniFi Access Application (Version 4.3.3 and earlier)

Mitigation:

Update your UniFi Access Application to Version 4.3.5 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77546 (Brandon Rossi)

Summary 14 of 22

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

Affected Products:

UniFi Access Application (Version 4.3.3 and earlier)

Mitigation:

Update your UniFi Access Application to Version 4.3.5 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77547 (Brandon Rossi)

Summary 15 of 22

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

Affected Products:

UniFi Protect Application (Version 7.1.87 and earlier)

Mitigation:

Update your UniFi Protect Application to Version 7.2.105 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77548 (Brandon Rossi)

Summary 16 of 22

A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

Affected Products:

UniFi OS Server (Version 5.1.21 and earlier)

Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall and Express 7 (Version 5.1.26 and earlier)

Express (Version 4.0.16 and earlier)

Mitigation:

Update your UniFi OS Server to Version 5.1.37 or later.

Update your Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall and Express 7 to Version 5.1.31 or later.

Update your Network Attached Storage to Version 5.1.32 or later.

Update your Express to Version 4.0.17 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.0 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77549 (Griffin Francis & Adrian Wood)

Summary 17 of 22

A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

Affected Products:

UniFi OS Server (Version 5.1.21 and earlier)

Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall and Express 7 (Version 5.1.26 and earlier)

Express (Version 4.0.16 and earlier)

Mitigation:

Update your UniFi OS Server to Version 5.1.37 or later.

Update your Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall and Express 7 to Version 5.1.31 or later.

Update your Network Attached Storage to Version 5.1.32 or later.

Update your Express to Version 4.0.17 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 10.0 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77550 (Tobia Righi (mastersplinter), Scott Curtis (syndrome_impostor), Calvin Star (Skelet4r), at TurtleSec)

Summary 18 of 22

A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro to escalate privileges on the device.

Affected Products:

UniFi Connect Display Cast Pro (Version 1.0.108 and earlier)

Mitigation:

Update your UniFi Connect Display Cast Pro to Version 1.0.111 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.0 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77551 (Andy Gill, ZephrSec Ltd)

Summary 19 of 22

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device.

Affected Products:

UniFi Enterprise Audio/Video Bridge (Version 1.0.10 and earlier)

Mitigation:

Update your UniFi Enterprise Audio/Video Bridge to Version 1.0.11 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.8 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-77552 (Ben Koo (@kiddo_pwn))

Summary 20 of 22

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.

Affected Products:

UniFi Access Application (Version 4.3.3 and earlier)

Mitigation:

Update your UniFi Access Application to Version 4.3.5 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77553 (Brandon Rossi)

Summary 21 of 22

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device.

Affected Products:

UniFi Talk Application (Version 5.2.7 and earlier)

Mitigation:

Update your UniFi Talk Application to Version 5.3.2 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 10.0 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-77554 (Brandon Rossi)

Summary 22 of 22

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device.

Affected Products:

UniFi Protect AI Key (Version 2.1.3 and earlier)

Mitigation:

Update your UniFi Protect AI Key to Version 2.2.6 or later.

Impact:

CVSS Severity and Metrics:

Base Score: 9.8 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-77557 (Brandon Rossi)

Reference Links:

https://community.ui.com/releases/UniFi-Protect-Application-7-2-105/4fa06975-6aa3-4e3f-b7d5-8814e331d14c

https://community.ui.com/releases/UniFi-Network-Application-10-5-67/375288b9-a4b4-46f1-a19d-5c787d342c2b

https://community.ui.com/releases/UniFi-Connect-Application-3-24-22/700ffcb9-9392-485a-b8a3-fbcfb532dbae

https://community.ui.com/releases/UniFi-Access-Application-4-3-5/5893e0cb-b696-4d03-a154-9b77bfc9cf5a

https://community.ui.com/releases/UniFi-Talk-Application-5-3-2/b71f6ef3-46e3-48e8-bbd8-f3fe1303b864

https://community.ui.com/releases/UID-Enterprise-Agent-1-62-1/84c4d821-d10b-4852-9398-a1b9c2cc1c33

https://community.ui.com/releases/UniFi-OS-Server-5-1-37/ca9003ca-2c3f-42e6-9a1c-0a4f8edc0854

https://community.ui.com/releases/UniFi-OS-Cloud-Keys-5-1-31/799661f9-444a-4870-80be-ea8185aec47c

https://community.ui.com/releases/UniFi-OS-Network-Video-Recorders-5-1-31/7a703038-6610-4ba7-a0df-9e65cc2b2bd3

https://community.ui.com/releases/UniFi-OS-Enterprise-Network-Video-Recorders-5-1-31/d0dc2173-557d-486f-9734-7da0ff55ab34

https://community.ui.com/releases/UniFi-OS-Enterprise-Network-Attached-Storage-5-1-31/13a3cb28-6736-4eab-82cc-fdb222e259ae

https://community.ui.com/releases/UniFi-OS-Network-Attached-Storage-5-1-32/ac8f3320-6ca1-4770-ae06-50074050e4b4

https://community.ui.com/releases/UniFi-OS-Dream-Machines-5-1-31/43fabe07-77c5-42e9-ba67-2b87543e800a

https://community.ui.com/releases/UniFi-OS-Enterprise-Firewall-Core-5-1-31/70df1c30-3a3a-4304-9c9b-5ea64ad5f006

https://community.ui.com/releases/UniFi-OS-Dream-Routers-5-1-31/ae1111a4-f32d-459b-9ede-169e50352b1d

https://community.ui.com/releases/UniFi-OS-Enterprise-Fortress-Gateway-5-1-31/0000f8df-12e4-4b2d-9ea7-6a57bd9e7790

https://community.ui.com/releases/UniFi-OS-Cloud-Gateways-5-1-31/c922a942-a986-4151-9c39-45fa687be497

https://community.ui.com/releases/UniFi-OS-Dream-Wall-5-1-31/ba488ae0-9e0e-4937-aa11-295fb67010fc

https://community.ui.com/releases/UniFi-OS-Express-7-5-1-31/03b70993-400b-4306-ab63-7bb589dceda3

https://community.ui.com/releases/UniFi-Connect-Display-Cast-Pro-1-0-111/b9eb3af9-ca85-4404-82aa-34275cf8d948

https://community.ui.com/releases/UniFi-Enterprise-Audio-Video-Bridge-1-0-11/f8cca748-2118-4446-b229-b83363f9b83d

https://community.ui.com/releases/UniFi-Protect-AI-Key-2-2-6/c8116136-a594-47a2-982e-9575ef9cc492

https://community.ui.com/releases/UniFi-OS-Express-4-0-17/89813804-9deb-4cd9-a5dc-f36f6c7514b4

Updated: July 26, 2026

Published: July 2, 2026

Version: 1.1

Revision: 1.1

Summary 1 of 25

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Injection on the host device.

Affected Products:

UniFi Connect Application (Version 3.24.16 and earlier)

Mitigation:

Update your UniFi Connect Application to Version 3.24.20 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 10.0 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE:  CVE-2026-50746 (Duc Anh Nguyen (@heckintosh_))

Summary 2 of 25

A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device.

Affected Products:

UniFi Talk Application (Version 5.1.2 and earlier)

Mitigation:

Update your UniFi Talk Application to Version 5.2.2 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-50747 (Abdulaziz Almadhi | Catchify Security)

Summary 3 of 25

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

Affected Products:

UniFi Access Application (Version 4.2.28 and earlier)

Mitigation:

Update your UniFi Access Application to Version 4.2.29 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-50748 (Abdulaziz Almadhi | Catchify Security)

Summary 4 of 25

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.

Affected Products:

UniFi Access Application (Version 4.2.28 and earlier)

Mitigation:

Update your UniFi Access Application to Version 4.2.29 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.1 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-54400 (Abdulaziz Almadhi | Catchify Security)

Summary 5 of 25

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.

Affected Products:

UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber (Version 5.1.15 and earlier)

UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.16 and earlier)

EF-Core (Version 5.1.18 and earlier)

Mitigation:

Update your UniFi OS Server, UDM, UDM-Beast, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber to Version 5.1.19 or later.

Update your UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 to Version 5.1.19 or later.

Update your EF-Core to Version 5.1.19 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.7 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE: CVE-2026-54401 (Kerolos Sameh | oathnet.org)

Summary 6 of 25

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

Affected Products:

UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber (Version 5.1.15 and earlier)

UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.16 and earlier)

EF-Core (Version 5.1.18 and earlier)

Mitigation:

Update your UniFi OS Server, UDM, UDM-Beast, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber to Version 5.1.19 or later.

Update your UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 to Version 5.1.19 or later.

Update your EF-Core to Version 5.1.19 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-54402 (arqblasta)

Summary 7 of 25

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.

Affected Products:

UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber (Version 5.1.15 and earlier)

UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.16 and earlier)

EF-Core (Version 5.1.18 and earlier)

Mitigation:

Update your UniFi OS Server, UDM, UDM-Beast, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber to Version 5.1.19 or later.

Update your UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 to Version 5.1.19 or later.

Update your EF-Core to Version 5.1.19 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.6 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE:  CVE-2026-54403 (Griffin Francis & Adrian Wood)

Note: This CVE can be chained with other vulnerabilities to eliminate the requirement for low-privileged access.

Summary 8 of 25

A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.

Affected Products:

UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber (Version 5.1.15 and earlier)

UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.16 and earlier)

EF-Core (Version 5.1.18 and earlier)

Mitigation:

Update your UniFi OS Server, UDM, UDM-Beast, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber to Version 5.1.19 or later.

Update your UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 to Version 5.1.19 or later.

Update your EF-Core to Version 5.1.19 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.8 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-54404 (Garett Kopcha (0x5t))

Summary 9 of 25

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Denial of Service (DoS) attack on the application.

Affected Products:

UniFi Network Application (Version 10.3.58 and earlier)

Mitigation:

Update your UniFi Network Application to Version 10.4.57 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.5 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE: CVE-2026-54405 (Dries from UniHosted)

Summary 10 of 25

A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in self-hosted instances of UniFi Network Application to escalate write permission on the host device.

Affected Products:

UniFi Network Application (Version 10.3.58 and earlier)

Mitigation:

Update your UniFi Network Application to Version 10.4.57 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.7 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

CVE:  CVE-2026-54406 (Garett Kopcha (0x5t))

Summary 11 of 25

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication in certain UniFi Protect Application API endpoints.

Affected Products:

UniFi Protect Application (Version 7.1.77 and earlier)

Mitigation:

Update your UniFi Protect Application to Version 7.1.83 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.6 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CVE:  CVE-2026-54407 (Abdulaziz Almadhi / Catchify Security Team)

Summary 12 of 25

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication for data streaming.

Affected Products:

UniFi Protect Application (Version 7.1.77 and earlier)

Mitigation:

Update your UniFi Protect Application to Version 7.1.83 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.6 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

CVE: CVE-2026-54408 (Brandon Rossi)

Summary 13 of 25

A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authentication in UniFi Protect Cameras.

Affected Products:

UniFi Protect Application (Version 7.1.77 and earlier)

Mitigation:

Update your UniFi Protect Application to Version 7.1.83 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.5 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE: CVE-2026-54409 (Michał Suda (klumz33))

Summary 14 of 25

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session. 

Affected Products:

UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber (Version 5.1.15 and earlier)

UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.16 and earlier)

EF-Core (Version 5.1.18 and earlier)

Mitigation:

Update your UniFi OS Server, UDM, UDM-Beast, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber to Version 5.1.19 or later.

Update your UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 to Version 5.1.19 or later.

Update your EF-Core to Version 5.1.19 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.5 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE: CVE-2026-55110 (Andy Gill, ZephrSec Ltd)

Summary 15 of 25

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to access files on the UniFi Protect Floodlight.

Affected Products:

UniFi Protect Floodlight(Version 1.13.4 and earlier)

Mitigation:

Update your UniFi Protect Floodlight to Version 1.13.6 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.5 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE: CVE-2026-55111 (Logan Fernandez (enzyme0))

Summary 16 of 25

A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device.

Affected Products:

UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, UDW, UDR, UDR7, UDR-5G, UCKP, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Max, UCG-Industrial and UCG-Fiber (Version 5.1.15 and earlier)

Mitigation:

Update your UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, UDW, UDR, UDR7, UDR-5G, UCKP, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Max, UCG-Industrial and UCG-Fiber to Version 5.1.19 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.5 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-55112 (Brandon Rossi)

Summary 17 of 25

A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Application to execute a Denial of Service (DoS) attack and bypass authentication in certain UniFi Talk API endpoints.

Affected Products:

UniFi Talk Application (Version 5.1.2 and earlier)

Mitigation:

Update your UniFi Talk Application to Version 5.2.2 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.5 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H

CVE: CVE-2026-55113 (Duc Anh Nguyen (@heckintosh_))

Summary 18 of 25

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.

Affected Products:

UniFi Network Application (Version 10.3.58 and earlier)

Mitigation:

Update your UniFi Network Application to Version 10.4.57 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.8 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-55114 (Corbett3000)

Summary 19 of 25

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device.

Affected Products:

UniFi Protect Application (Version 7.1.77 and earlier)

Mitigation:

Update your UniFi Protect Application to Version 7.1.83 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-55115 (Brandon Rossi)

Summary 20 of 25

A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.

Affected Products:

UDM, UDM-Beast, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber (Version 5.1.15 and earlier)

EF-Core (Version 5.1.18 and earlier)

Mitigation:

Update your UDM, UDM-Beast, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, EF-Core, UDW, UDR, UDR7, UDR-5G, Express 7, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber to Version 5.1.19 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.0 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-55116 (Joseph Semaan)

Summary 21 of 25

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Application to access files on the host device.

Affected Products:

UniFi Access Application (Version 4.2.28 and earlier)

Mitigation:

Update your UniFi Access Application to Version 4.2.29 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.6 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE: CVE-2026-55117 (Brandon Rossi)

Summary 22 of 25

A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.

Affected Products:

UniFi Network Application (Version 10.3.58 and earlier)

Mitigation:

Update your UniFi Network Application to Version 10.4.57 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.3 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

CVE: CVE-2026-55118 (bs0xx)

Summary 23 of 25

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk Application to escalate privileges within the UniFi Talk Application.

Affected Products:

UniFi Talk Application (Version 5.1.2 and earlier)

Mitigation:

Update your UniFi Talk Application to Version 5.2.2 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.1 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVE: CVE-2026-55119 (Abdulaziz Almadhi | Catchify Security)

Summary 24 of 25

A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application to escalate privileges on the host device.

Affected Products:

UniFi Protect Application (Version 7.1.77 and earlier)

Mitigation:

Update your UniFi Protect Application to Version 7.1.83 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.8 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-56841 (Abdulaziz Almadhi | Catchify Security)

Summary 25 of 25

A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UniFi Network Application to persist privileges within UniFi Network Application after such access had been removed.

Affected Products:

UniFi Network Application (Version 10.3.58 and earlier)

Mitigation:

Update your UniFi Network Application to Version 10.4.57 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.5 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-56842 (BugBunny.ai)

Reference Links:

https://community.ui.com/releases/UniFi-Connect-Application-3-24-20/3e2cd403-d021-4d40-8e33-0007e9683d62

https://community.ui.com/releases/UniFi-Talk-Application-5-2-2/f27dcd51-f51b-4bc9-9a7f-ecbb215ceeb1

https://community.ui.com/releases/UniFi-Access-Application-4-2-29/63eac165-b7d4-4c43-8091-55ade3ec73c1

https://community.ui.com/releases/UniFi-Network-Application-10-4-57/92694b29-fd78-4d52-906a-3211136610e2

https://community.ui.com/releases/UniFi-Protect-Application-7-1-83/70e6c6a6-cd7f-43e6-87fc-4d70f0a1d9c6

https://community.ui.com/releases/UniFi-Protect-Floodlight-1-13-6/ff9550e4-5e40-473d-95f0-047de07e87dd

https://community.ui.com/releases/UniFi-OS-Dream-Machines-5-1-19/32c35941-c2b6-4fa2-9e63-09470bfb85f6

https://community.ui.com/releases/UniFi-OS-Enterprise-Firewall-Core-5-1-19/21263def-e96c-47e6-9a75-96293fcb84e0

https://community.ui.com/releases/UniFi-OS-Enterprise-Fortress-Gateway-5-1-19/45d861a0-fd93-43ee-841e-033423b112a2

https://community.ui.com/releases/UniFi-OS-Enterprise-Network-Video-Recorders-5-1-19/ca291ead-bc98-4e8b-bc85-4ec03de3f77d

https://community.ui.com/releases/UniFi-OS-Network-Video-Recorders-5-1-19/0728e007-aedd-4664-a3a1-38661b36f9bb

https://community.ui.com/releases/UniFi-OS-Cloud-Gateways-5-1-19/233f8d0a-9973-4e01-a51e-30713939b240

https://community.ui.com/releases/UniFi-OS-Cloud-Keys-5-1-19/44aabe56-c674-47f7-85f4-d483bb7c5bfe

https://community.ui.com/releases/UniFi-OS-Dream-Wall-5-1-19/c33cde37-ac2e-4015-bcb6-39567448fc35

https://community.ui.com/releases/UniFi-OS-Network-Attached-Storage-5-1-19/553addc7-4444-4eed-b46f-b2ee1f5f2285

https://community.ui.com/releases/UniFi-OS-Dream-Routers-5-1-19/b9ae8a01-9415-496a-92b2-70aa784de65d

https://community.ui.com/releases/UniFi-OS-Express-7-5-1-19/71fbc82e-da12-43df-82a7-6cd5a316e867

https://community.ui.com/releases/UniFi-OS-Server-5-1-19/05db58f8-3306-48dc-bbd8-6cb681046a6d

Published: Jun 10, 2026

Version: 1.0

Revision: 1.0

Summary 1 of 5

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device.

Affected Products:

UID Enterprise Agent (Version 1.61.3 and earlier)

Mitigation:

Update your UID Enterprise Agent to Version 1.61.4 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-47367 (Abdulaziz Almadhi | Catchify Security)

Summary 2 of 5

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such UniFi OS devices or instances.

Affected Products:

UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber (Version 5.1.12 and earlier)

UniFi OS Server (Version 5.0.8 and earlier)

UDM-Beast (Version 5.1.11 and earlier)

UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.10 and earlier)

Express (Version 4.0.14 and earlier)

Mitigation:

Update your UniFi OS Server, UDM, UDM-Beast, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber to Version 5.1.15 or later.

Update your UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 to Version 5.1.16 or later.

Update your Express to Version 4.0.15 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.6 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE: CVE-2026-47368 (Brandon Rossi)

Note: This CVE can be chained with other vulnerabilities to eliminate the requirement for low-privileged access.

Summary 3 of 5

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Affected Products:

UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber (Version 5.1.12 and earlier)

UniFi OS Server (Version 5.0.8 and earlier)

UDM-Beast (Version 5.1.11 and earlier)

UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.10 and earlier)

Express (Version 4.0.14 and earlier)

Mitigation:

Update your UniFi OS Server, UDM, UDM-Beast, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber to Version 5.1.15 or later.

Update your UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 to Version 5.1.16 or later.

Update your Express to Version 4.0.15 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-47369 (Brandon Rossi)

Summary 4 of 5

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.

Affected Products:

UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber (Version 5.1.12 and earlier)

UniFi OS Server (Version 5.0.8 and earlier)

UDM-Beast (Version 5.1.11 and earlier)

UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.10 and earlier)

Express (Version 4.0.14 and earlier)

Mitigation:

Update your UniFi OS Server, UDM, UDM-Beast, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber to Version 5.1.15 or later.

Update your UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 to Version 5.1.16 or later.

Update your Express to Version 4.0.15 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.9 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-47370 (Brandon Rossi)

Summary 5 of 5

Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.

Affected Products:

UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber (Version 5.1.12 and earlier)

UDM-Beast (Version 5.1.11 and earlier)

Mitigation:

Update your UDM, UDM-Beast, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber to Version 5.1.15 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.1 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-48610 (Duc Anh Nguyen (@heckintosh_))

Reference Links:

https://community.ui.com/releases/UID-Enterprise-Agent-1-61-4/142f588d-a6f1-44a2-adad-b631d7fcc859

https://community.ui.com/releases/UniFi-OS-Network-Attached-Storage-5-1-16/8342667f-08b5-4006-97d5-595593ea7e17

https://community.ui.com/releases/UniFi-OS-Express-7-5-1-15/84641421-6507-48af-914f-c0cb5f704c76

https://community.ui.com/releases/UniFi-OS-Network-Video-Recorders-5-1-15/b208b498-7e6b-4ba2-8314-a1f8436e1746

https://community.ui.com/releases/UniFi-OS-Enterprise-Network-Video-Recorders-5-1-15/6d0b2652-08dd-46e9-9850-750e7cf46753

https://community.ui.com/releases/UniFi-OS-Dream-Wall-5-1-15/353c7ec2-fb95-4820-89fa-1f04e4a7e574

https://community.ui.com/releases/UniFi-OS-Dream-Routers-5-1-15/2ba464cc-e812-40f5-8e73-20a55dc0ba55

https://community.ui.com/releases/UniFi-OS-Enterprise-Fortress-Gateway-5-1-15/e41884b0-04c6-44e4-89c5-a3f96c41e709

https://community.ui.com/releases/UniFi-OS-Dream-Machines-5-1-15/5ed916bc-aa53-4618-81b4-d97d45590b8d

https://community.ui.com/releases/UniFi-OS-Cloud-Keys-5-1-15/eef40b81-7b36-4dda-a76e-3086f0bbd68b

https://community.ui.com/releases/UniFi-OS-Cloud-Gateways-5-1-15/37aeb9f3-c3a2-474d-ac9a-aa2ec7ecf417

https://community.ui.com/releases/UniFi-OS-Server-5-1-15/11843c60-7c4f-4263-9773-4c3df7168d07

https://community.ui.com/releases/UniFi-OS-Express-4-0-15/8821b99b-bc3e-49cd-88bb-1a348f2b2a90

Published: May 21, 2026

Updated: May 22, 2026

Version: 1.1

Revision: 1.1

Summary 1 of 5

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

Affected Products:

UniFi OS Server (Version 5.0.6 and earlier)

Mitigation:

Update your UniFi OS Server to Version 5.0.8 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.1 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-33000 (V3rlust)

Summary 2 of 5

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

Affected Products:

UCG-Industrial (Version 5.0.13 and earlier)

UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max and UCG-Fiber (Version 5.0.16 and earlier)

UDR-5G, ENVR-Core, UCKP, UCK and UCK-Enterprise (Version 5.0.17 and earlier)

UniFi OS Server (Version 5.0.6 and earlier)

UNVR-G2 and UNVR-G2-Pro (Version 5.1.11 and earlier)

UDM-Beast, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.8 and earlier)

Mitigation:

Update your UCG-Industrial to Version 5.1.12 or later.

Update your UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max and UCG-Fiber to Version 5.1.12 or later.

Update your UDR-5G, ENVR-Core, UCKP, UCK and UCK-Enterprise to Version 5.1.12 or later.

Update your UniFi OS Server to Version 5.0.8 or later.

Update your UNVR-G2 and UNVR-G2-Pro to Version 5.1.12 or later.

Update your UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 to Version 5.1.10 or later.

Update your UDM-Beast 5.1.11 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 10.0 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-34908 (Duc Anh Nguyen (@heckintosh_))

Summary 3 of 5

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

Affected Products:

UCG-Industrial (Version 5.0.13 and earlier)

UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max and UCG-Fiber (Version 5.0.16 and earlier)

UDR-5G, ENVR-Core, UCKP, UCK and UCK-Enterprise (Version 5.0.17 and earlier)

UniFi OS Server (Version 5.0.6 and earlier)

UNVR-G2 and UNVR-G2-Pro (Version 5.1.11 and earlier)

UDM-Beast, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.8 and earlier)

Express (Version 4.0.13 and earlier)

Mitigation:

Update your UCG-Industrial to Version 5.1.12 or later.

Update your UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max and UCG-Fiber to Version 5.1.12 or later.

Update your UDR-5G, ENVR-Core, UCKP, UCK and UCK-Enterprise to Version 5.1.12 or later.

Update your UniFi OS Server to Version 5.0.8 or later.

Update your UNVR-G2 and UNVR-G2-Pro to Version 5.1.12 or later.

Update your UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 to Version 5.1.10 or later.

Update your UDM-Beast 5.1.11 or later.

Update your Express to Version 4.0.14 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 10.0 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-34909 (Abdulaziz Almadhi | Catchify Security)

Summary 4 of 5

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

Affected Products:

UCG-Industrial (Version 5.0.13 and earlier)

UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max and UCG-Fiber (Version 5.0.16 and earlier)

UDR-5G, ENVR-Core, UCKP, UCK and UCK-Enterprise (Version 5.0.17 and earlier)

UniFi OS Server (Version 5.0.6 and earlier)

UNVR-G2 and UNVR-G2-Pro (Version 5.1.11 and earlier)

UDM-Beast, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.8 and earlier)

Mitigation:

Update your UCG-Industrial to Version 5.1.12 or later.

Update your UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max and UCG-Fiber to Version 5.1.12 or later.

Update your UDR-5G, ENVR-Core, UCKP, UCK and UCK-Enterprise to Version 5.1.12 or later.

Update your UniFi OS Server to Version 5.0.8 or later.

Update your UNVR-G2 and UNVR-G2-Pro to Version 5.1.12 or later.

Update your UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 to Version 5.1.10 or later.

Update your UDM-Beast 5.1.11 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 10.0 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-34910 (John Carroll)

Summary 5 of 5

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.

Affected Products:

UCG-Industrial (Version 5.0.13 and earlier)

UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max and UCG-Fiber (Version 5.0.16 and earlier)

UDR-5G, ENVR-Core, UCKP, UCK and UCK-Enterprise (Version 5.0.17 and earlier)

UniFi OS Server (Version 5.0.6 and earlier)

UNVR-G2 and UNVR-G2-Pro (Version 5.1.11 and earlier)

UDM-Beast, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.8 and earlier)

Mitigation:

Update your UCG-Industrial to Version 5.1.12 or later.

Update your UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max and UCG-Fiber to Version 5.1.12 or later.

Update your UDR-5G, ENVR-Core, UCKP, UCK and UCK-Enterprise to Version 5.1.12 or later.

Update your UniFi OS Server to Version 5.0.8 or later.

Update your UNVR-G2 and UNVR-G2-Pro to Version 5.1.12 or later.

Update your UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 to Version 5.1.10 or later.

Update your UDM-Beast 5.1.11 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.7 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE: CVE-2026-34911 (Hakai Security)

Reference Links:

https://community.ui.com/releases/UniFi-OS-Server-5-0-8/6b00e638-d383-4767-b886-fde29f5e331b

https://community.ui.com/releases/UniFi-OS-Cloud-Gateways-5-1-12/41549e59-0a2f-4ee9-8450-dee7ec15a58d

https://community.ui.com/releases/UniFi-OS-Dream-Routers-5-1-12/4f165cc3-22ab-4144-916d-3c4da7afee3b

https://community.ui.com/releases/UniFi-OS-Express-7-5-1-12/abe29aaa-2851-4247-9a92-076a4a467841

https://community.ui.com/releases/UniFi-OS-Network-Attached-Storage-5-1-10/6a999e8b-0985-403b-b865-8f3ad63eb60e

https://community.ui.com/releases/UniFi-OS-Enterprise-Network-Video-Recorders-5-1-12/e01ca704-079d-40ec-81d0-a36ecfa1f277

https://community.ui.com/releases/UniFi-OS-Network-Video-Recorders-5-1-12/c3b995a8-3bea-4830-a265-50f077ed9f7f

https://community.ui.com/releases/UniFi-OS-Cloud-Keys-5-1-12/b8c2c586-be95-44e1-921c-26201f1838ea

https://community.ui.com/releases/UniFi-OS-Enterprise-Fortress-Gateway-5-1-12/9427e825-b0c9-487d-b2a9-5cbb393f219a

https://community.ui.com/releases/UniFi-OS-Dream-Machines-5-1-12/6a229a80-ed47-4509-a9a3-046122ecc1b9

https://community.ui.com/releases/UniFi-OS-Dream-Machine-Beast-5-1-11/12eae3e2-94b5-4efe-81d8-e5881721fb22

https://community.ui.com/releases/UniFi-OS-Dream-Wall-5-1-12/e2fc2a8c-7546-4e7a-b545-5cabb1f5570f

https://community.ui.com/releases/UniFi-OS-Express-4-0-14/f0b5dbcf-c3b9-4daa-8034-14d0900d07bd

Published: April 07, 2026

Version: 1.0

Revision: 1.0

Summary 1 of 5

A malicious actor with access to the UniFi Play network could exploit a Path Traversal vulnerability found in the device firmware to write files on the system that could be used for a remote code execution (RCE).

Affected Products:

UniFi Play PowerAmp (Version 1.0.35 and earlier)

UniFi Play Audio Port (Version 1.0.24 and earlier)

Mitigation:

Update UniFi Play PowerAmp to Version 1.0.38 or later

Update UniFi Play Audio Port to Version 1.1.9 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.8 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-22562 (Bongeun Koo (@kiddo_pwn))

Summary 2 of 5

A series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access to the UniFi Play network.

Affected Products:

UniFi Play PowerAmp (Version 1.0.35 and earlier)

UniFi Play Audio Port (Version 1.0.24 and earlier)

Mitigation:

Update UniFi Play PowerAmp to Version 1.0.38 or later

Update UniFi Play Audio Port to Version 1.1.9 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.8 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-22563 (Bongeun Koo (@kiddo_pwn))

Summary 3 of 5

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthorized changes to the system.

Affected Products:

UniFi Play PowerAmp (Version 1.0.35 and earlier)

UniFi Play Audio Port (Version 1.0.24 and earlier)

Mitigation:

Update UniFi Play PowerAmp to Version 1.0.38 or later

Update UniFi Play Audio Port to Version 1.1.9 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.8 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-22564 (Bongeun Koo (@kiddo_pwn))

Summary 4 of 5

An Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi Play network to cause the device to stop responding.

Affected Products:

UniFi Play PowerAmp (Version 1.0.35 and earlier)

UniFi Play Audio Port (Version 1.0.24 and earlier)

Mitigation:

Update UniFi Play PowerAmp to Version 1.0.38 or later

Update UniFi Play Audio Port to Version 1.1.9 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.5 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE: CVE-2026-22565 (Bongeun Koo (@kiddo_pwn))

Summary 5 of 5

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credentials.

Affected Products:

UniFi Play PowerAmp (Version 1.0.35 and earlier)

UniFi Play Audio Port (Version 1.0.24 and earlier)

Mitigation:

Update UniFi Play PowerAmp to Version 1.0.38 or later

Update UniFi Play Audio Port to Version 1.1.9 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.5 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE: CVE-2026-22566 (Bongeun Koo (@kiddo_pwn))

Reference Links:

https://community.ui.com/releases/UniFi-Play-PowerAmp-1-0-38/6f17da40-f0d2-4a7e-89e3-2133b89ff5a7

https://community.ui.com/releases/UniFi-Play-Audio-Port-1-1-9/2e270ee4-9a7e-4307-967a-f9cd900bef83

Published: March 18, 2026

Updated: March 21,2026

Version: 1.1

Revision: 1.1

Summary 1 of 3

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account. 

Affected Products:

Official Release: UniFi Network application (Version 10.1.85 and earlier)

Release Candidate: UniFi Network application (Version 10.2.93 and earlier)

UniFi Express (UX): UniFi Network application (Version 9.0.114 and earlier)

Mitigation:

Official Release: Update UniFi Network application to Version 10.1.89 or later.

Release Candidate: Update UniFi Network application to Version 10.2.97 or later.

UniFi Express (UX): Update UniFi Express firmware to 4.0.13 or later, which updates the UniFi Network application to Version 9.0.118 or later.

Impact:

CVSS v3.1 Severity and Metrics:

Base Score: 10.0 (Critical)

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-22557 (n00r3(@izn0u))

Summary 2 of 3

An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to the network to escalate privileges.

Affected Products:

Official Release: UniFi Network application (Version 10.1.85 and earlier)

Release Candidate: UniFi Network application (Version 10.2.93 and earlier)

UniFi Express (UX): UniFi Network application (Version 9.0.114 and earlier) 

Mitigation:

Official Release: Update UniFi Network application to Version 10.1.89 or later.

Release Candidate: Update UniFi Network application to Version 10.2.97 or later.

UniFi Express (UX): Update UniFi Express firmware to 4.0.13 or later, which updates the UniFi Network application to Version 9.0.118 or later.

Impact:

CVSS v3.1 Severity and Metrics:

Base Score: 7.7 (High)

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE: CVE-2026-22558 (Garett Kopcha (@0x5t))

Summary 3 of 3

An Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access to an account if the account owner is socially engineered into clicking a malicious link.

Affected Products:

UniFi Network Server (Version 10.1.85 and earlier)

Mitigation:

Update UniFi Network Server to Version 10.1.89 or later.

Impact:

CVSS v3.1 Severity and Metrics:

Base Score: 8.8 (High)

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE: CVE-2026-22559 (Shubham Gupta (@hackerspider1))

Reference Links:

https://community.ui.com/releases/UniFi-OS-Express-4-0-13/27e4730e-5fb7-4303-9c0f-d2f572d861c2

https://community.ui.com/releases/UniFi-Network-Application-10-2-97/7c599511-d03a-4dce-8832-93b90cbaa41d

https://community.ui.com/releases/UniFi-Network-Application-10-1-89/625f366f-7ea5-4266-bd9f-500180494035

https://community.ui.com/releases/UniFi-Network-Application-9-0-118/72fa9862-3c4f-4e9b-a028-4fc7a0b2ba28

Published: January 06, 2026

Version: 1.0

Revision: 1.0

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.

Affected Products:

airMAX AC (Version 8.7.20 and earlier)

airMAX M (Version 6.3.22 and earlier)

airFiber AF60-XG (Version 1.2.2 and earlier)

airFiber AF60 (Version 2.6.7 and earlier)

Mitigation:

Update your airMAX AC to Version 8.7.21 or later.

Update your airMAX M to Version 6.3.24 or later.

Update your airFiber AF60-XG to Version 1.2.3 or later.

Update your airFiber AF60 to Version 2.6.8 or later.

Impact:

CVSS v3.1 Severity and Metrics:

Base Score: 8.8 (High)

Vector: 

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-21639 (Gaston Aznarez, Principal Security Researcher at Faraday)

Reference Links:

https://community.ui.com/releases/airMAX-AC-8-7-21/804eb7e2-1790-4143-8e98-2e8c0e29463e

https://community.ui.com/releases/airMAX-M-6-3-24/e190e518-36dd-4430-9a1d-73a5866121b3

https://community.ui.com/releases/AF60-HD-XG-1-2-3/d376023a-4698-47eb-9c70-4b2d5e8f4c41

https://community.ui.com/releases/AF60-AF60-LR-2-6-8/701398a3-858f-455c-9b84-9c964343a533

Published: January 06, 2026

Version: 1.0

Revision: 1.0

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.

Affected Products:

UBB-XG (Version 1.2.2 and earlier)

UDB-Pro/UDB-Pro-Sector (Version 1.4.1 and earlier)

UBB (Version 3.1.5 and earlier)

Mitigation:

Update your UBB-XG to Version 1.2.3 or later.

Update your UDB-Pro/UDB-Pro-Sector to Version 1.4.2 or later.

Update your UBB to Version 3.1.7 or later.

Impact:

CVSS v3.1 Severity and Metrics:

Base Score: 8.8 (High)

Vector: 

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-21638 (Gaston Aznarez, Principal Security Researcher at Faraday)

Reference Links:

https://community.ui.com/releases/UniFi-Building-Bridge-XG-1-2-3/c1eede93-ed3a-47e1-b912-2a8ab46b9cfa

https://community.ui.com/releases/UniFi-Device-Bridge-Pro-Sector-1-4-2/59fb6e3a-5b8e-4645-b841-41df2edca2c9

https://community.ui.com/releases/UniFi-Building-Bridge-3-1-7/6fd38113-df70-4e13-9b26-678371b71c72

Published: January 5, 2025

Version: 1.0

Revision: 1.0

An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device that was only adopted via Ethernet.

Affected Products:

UniFi Connect EV Station Lite (Version 1.5.2 and earlier)

Mitigation:

Update UniFi Connect EV Station Lite to Version 1.6.1 or later. 

Impact:

CVSS v3.1 Severity and Metrics:

Base Score: 5.3 (Medium)

Vector: 

CVSS: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE: CVE-2026-21635 (Bongeun Koo (@kiddo_pwn))

Reference Links:

https://community.ui.com/releases/UniFi-Connect-EV-Station-Lite-1-6-1/812cb388-7806-4638-9f1a-39ae4bf5f93f

Published: January 5, 2026

Version: 1.0

Revision: 1.0

Summary 1 of 2

A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application (Version 6.1.79 and earlier).

Affected Products:

UniFi Protect Application (Version 6.1.79 and earlier).

Mitigation:

Update your UniFi Protect Application to Version 6.2.72 or later.

Impact:

CVSS v3.1 Severity and Metrics:

Base Score: 8.8 High

Vector: 

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-21633 (David BERARD from @Synacktiv working with Trend Micro Zero Day Initiative)

Summary 2 of 2

A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery protocol causing it to restart.

Affected Products:

UniFi Protect Application (Version 6.1.79 and earlier).

Mitigation:

Update your UniFi Protect Application to Version 6.2.72 or later.

Impact:

CVSS v3.1 Severity and Metrics:

Base Score: 6.5 Medium

Vector: 

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE: CVE-2026-21634 (David BERARD from @Synacktiv working with Trend Micro Zero Day Initiative)

Reference Links:

https://community.ui.com/releases/UniFi-Protect-Application-6-2-72/b45268b0-bee2-41c7-b409-8e2d5c0ca47c

Published: December 16, 2025

Version: 1.0

Revision: 1.0

A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. 

This plugin is disabled by default.

Affected Products:

UCRM Argentina AFIP invoices Plugin (Version 1.2.0 and earlier)

Mitigation:

Update UCRM Argentina AFIP invoices Plugin to Version 1.3.0 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.5 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE: CVE-2025-59467 (Rishabh Jain (RJCyber) of cyberplanet)

Published: October 23, 2025

Version: 1.0

Revision: 1.0

A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. 

Affected Products:

UniFi Access Application (Version 3.3.22 through 3.4.31).

Mitigation:

Update your UniFi Access Application to Version 4.0.21 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 10.0 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2025-52665 (Catchify Security (@catchifySA))

Reference Links:

https://community.ui.com/releases/UniFi-Access-Application-4-0-21/f3b63db6-6e51-442e-b5a6-24b67fe82f44

Published: October 15, 2025

Version: 1.0

Revision: 1.0

A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an attacker with access to the UniFi Talk management network to execute internal debug operations through the device API.

Affected Products:

UniFi Talk Touch (Version 1.21.16 and earlier)

UniFi Talk Touch Max (Version 2.21.22 and earlier)

UniFi Talk G3 Phones (Version 3.21.26 and earlier)

Mitigation:

Update the UniFi Talk Touch to Version 1.21.17 or later.

Update the UniFi Talk Touch Max to Version 2.21.23 or later.

Update the UniFi Talk G3 Phones to Version 3.21.27 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.3 High

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVE: CVE-2025-52663 (Junhyung Cho (@da2rim) & Bongeun Koo (@kiddo_pwn))

Reference Links:

https://community.ui.com/releases/UTP-Touch-1-21-17/d38229dd-7940-4dd8-a888-d5c902cfe961

https://community.ui.com/releases/UTP-Touch-Max-2-21-23/7e92e95a-a2f7-4f31-88d8-04c98c0da282

https://community.ui.com/releases/UniFi-Talk-G3-Phones-3-21-27/f7c84184-9d09-4ef4-960b-a2717a68e780

Published: Aug 13, 2025

Version: 1.0

Revision: 1.0

An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network.

Affected Products:

EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) 

Mitigation:

Update the EdgeMAX EdgeSwitch to Version 1.11.1 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.5 High

Vector: 

CVSS: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2025-48978 (Jeff Barbi)

Reference Links:

https://community.ui.com/releases/EdgeMAX-EdgeSwitch-1-11-1/ffb7c3ab-94c5-4c98-bd55-d9fc93769c77

Published: Aug 07, 2025

Updated: Aug 18, 2025

Version: 1.2

Revision: 1.2

Summary 1 of 3

Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to escalate privileges. 

Affected Products:

UISP Application (Version 2.4.211 and earlier)

Mitigation:

Update UISP Application to Version 2.4.220 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.1 High

Vector: 

CVSS: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CVE: CVE-2025-27216 (abdulsec @moodiAbdoul and n00r3 @izn0u)

Summary 2 of 3

A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application scope.

Affected Products:

UISP Application (Version 2.4.211 and earlier)

Mitigation:

Update UISP Application to Version 2.4.220 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 6.3 Medium

Vector: 

CVSS: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE: CVE-2025-27217 (Michael Price, Rishabh Jain and Muhammad Ali of cyberplanet)

Summary 3 of 3

An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access.

Affected Products:

UISP Application (Version 2.4.211 and earlier)

Mitigation:

Update UISP Application to Version 2.4.220 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 8.2 High

Vector: 

CVSS: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2025-48979 ( wa1tal0ne ) 

Reference Links:

https://community.ui.com/releases/UISP-Application-2-4-220/b428b276-c4a6-4b90-b97b-1860ff2bb46d

Published: Aug 06, 2025

Version: 1.0

Revision: 1.0

Summary 1 of 4

Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with network access to the UniFi Connect EV Station Lite.

Affected Products:

UniFi Connect EV Station Lite (Version 1.5.1 and earlier)

Mitigation:

Update UniFi Connect EV Station Lite to Version 1.5.2 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.8 Critical

Vector: 

CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2025-24285 (Bongeun Koo (@kiddo_pwn)

Summary 2 of 4

An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge (ADB) and make unsupported changes to the system.

Affected Products:

UniFi Connect EV Station Pro (Version 1.5.18 and earlier)

UniFi Connect Display (Version 1.9.324 and earlier)

UniFi Connect Display Cast (Version 1.9.301 and earlier)

UniFi Connect Display Cast Pro (Version 1.0.78 and earlier)

UniFi Connect Display Cast Lite (Version 1.0.3 and earlier)

Mitigation:

Update UniFi Connect EV Station Pro to Version 1.5.27 or later

Update UniFi Connect Display to Version 1.13.6 or later

Update UniFi Connect Display Cast to Version 1.10.3 or later

Update UniFi Connect Display Cast Pro to Version 1.0.83 or later

Update UniFi Connect Display Cast Lite to Version 1.1.3 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 4.9 Medium

Vector: 

CVSS: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

CVE: CVE-2025-27213 (Bongeun Koo (@kiddo_pwn and Sina Kheirkhah (@SinSinology) at Zero Day Initiative - Pwn2Own Automotive 2025 Tokyo)

Summary 3 of 4

A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical or adjacent access to perform an unauthorized factory reset.

Affected Products:

UniFi Connect EV Station Pro (Version 1.5.18 and earlier)

Mitigation:

Update UniFi Connect EV Station Pro to Version 1.5.27 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 6.5 Medium

Vector: 

CVSS: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE: CVE-2025-27214 (Bongeun Koo (@kiddo_pwn and Sina Kheirkhah (@SinSinology) at Zero Day Initiative - Pwn2Own Automotive 2025 Tokyo)

Summary 4 of 4

An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to the system.

Affected Products:

UniFi Connect Display Cast (Version 1.10.3 and earlier)

UniFi Connect Display Cast Pro (Version 1.0.89 and earlier)

UniFi Connect Display Cast Lite (Version 1.0.3 and earlier)

Mitigation:

Update UniFi Connect Display Cast to Version 1.10.7 or later

Update UniFi Connect Display Cast Pro to Version 1.0.94 or later

Update UniFi Connect Display Cast Lite to Version 1.1.8 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 2.7 Low

Vector: 

CVSS: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

CVE: CVE-2025-27215 (Bongeun Koo (@kiddo_pwn) & Junhyung Cho (@da2rim))

Reference Links:

https://community.ui.com/releases/UniFi-Connect-EV-Station-Lite-1-5-2/7c98114e-8e8f-43a0-b741-f64d5d6ca0b2

https://community.ui.com/releases/UniFi-Connect-EV-Station-Pro-1-5-27/d465b2c9-63f3-4ae2-b387-6ea11460c938

https://community.ui.com/releases/UniFi-Connect-Display-1-13-6/f4a26d7b-0134-4605-b3cc-5384f429e349

https://community.ui.com/releases/UniFi-Connect-Display-Cast-1-10-7/dbda7a50-e99e-4e31-bc2a-8019436ff081

https://community.ui.com/releases/UniFi-Connect-Display-Cast-Pro-1-0-94/f184a367-1781-49c3-896a-820368022226

https://community.ui.com/releases/UniFi-Connect-Display-Cast-Lite-1-1-8/ca33b370-4aef-4a63-bc75-96e63e30750d

Published: July 16, 2025

Version: 1.0

Revision: 1.0

An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network.

Affected Products:

UniFi Access Reader Pro (Version 2.14.21 and earlier)

UniFi Access G2 Reader Pro (Version 1.10.32 and earlier)

UniFi Access G3 Reader Pro (Version 1.10.30 and earlier)

UniFi Access Intercom (Version 1.7.28 and earlier)

UniFi Access G3 Intercom (Version 1.7.29 and earlier)

UniFi Access Intercom Viewer (Version 1.3.20 and earlier)

Mitigation:

Update UniFi Access Reader Pro to Version 2.15.9 or later

Update UniFi Access G2 Reader Pro to Version 1.11.23 or later

Update UniFi Access G3 Reader Pro to Version 1.11.22 or later

Update UniFi Access Intercom to Version 1.8.22 or later

Update UniFi Access G3 Intercom to Version 1.8.22 or later

Update UniFi Access Intercom Viewer to Version 1.4.39 or later

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.8 Critical

Vector: 

CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2025-27212 (Bongeun Koo (@kiddo_pwn) & Junhyung Cho (@da2Rim))

Reference Links:

https://community.ui.com/releases/UniFi-Access-Reader-Pro-2-15-9/e77b14b5-226a-4efa-b8dc-dfe21666b046

https://community.ui.com/releases/UniFi-Access-G2-Reader-Pro-1-11-23-0/77ccbd66-43ee-48ed-8d23-c3b73f0b3c64

https://community.ui.com/releases/UniFi-Access-G3-Reader-Pro-1-11-22-0/36dca6a6-9e81-4866-81a2-15564f152cd7

https://community.ui.com/releases/UniFi-Access-Intercom-1-8-22-0/b8ab8c22-2409-4634-8443-21d726ff48eb

https://community.ui.com/releases/UniFi-Access-G3-Intercom-1-8-22-0/f4ac029c-b837-4bf9-853a-efa309971e44

https://community.ui.com/releases/UniFi-Access-Intercom-Viewer-1-4-39/d7c04f1e-4438-4c66-8f13-93a4e93cbbab

Published: July 14, 2025

Version: 1.0

Revision: 1.0

An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network.

Affected Products:

EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) 

Mitigation:

Update the EdgeMAX EdgeSwitch to Version 1.11.0 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 7.5 High

Vector: 

CVSS: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2025-27211 (Jeff Barbi)

Reference Links:

https://community.ui.com/releases/EdgeMAX-EdgeSwitch-1-11-0/8b84659e-8193-4b2d-b905-cb1ceb06097b

Published: July 7, 2025

Version: 1.1

Revision: 1.1

A misconfigured query in UniFi Network (v9.0.108 and earlier) could allow users to authenticate to Enterprise WiFi or VPN Server (l2tp and OpenVPN) using a device’s MAC address from 802.1X or MAC Authentication, if both services are enabled and share the same RADIUS profile.

Affected Products:

UniFi Network application (Version 9.0.108 and earlier) 

Mitigation:

Update the UniFi Network application to Version 9.0.114 or later.

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 6.8 Medium

Vector: 

CVSS: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE: CVE-2025-24292 (Kent Seymour)

Reference Links:

https://community.ui.com/releases/UniFi-Network-Application-9-0-114/35b6e9ac-f63d-46c9-bbbe-74a4a61ac95f