Loading story…
Ubiquiti disclosed two significant vulnerabilities in its UniFi Protect Application, affecting versions 6.1.79 and earlier. The first, CVE-2026-21633, is an improper authentication vulnerability in the discovery protocol that allows a network-adjacent, unauthenticated attacker to gain unauthorized access to UniFi Protect cameras. The second, CVE-2026-21634, is a buffer overflow vulnerability in the same protocol, which can be exploited to cause a denial-of-service (DoS) condition by restarting the application. Both vulnerabilities require the attacker to be on the same network segment as the target device.
The vulnerabilities have been rated high (CVSS 8.8) and medium (CVSS 6.5) respectively, and users are strongly advised to upgrade to UniFi Protect Application version 6.2.72 or later to mitigate the risks. Exploitation of these flaws could result in unauthorized surveillance access or disruption of video management services. Asset discovery tools can be used to identify potentially vulnerable systems within an organization’s network for prompt remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On January 6, 2026, runZero published analysis and asset discovery guidance covering Ubiquiti's recently disclosed UniFi Protect vulnerabilities, including CVE-2026-21633 and CVE-2026-21634. The post provided inventory queries to help organizations find exposed or vulnerable systems on their networks.
On January 5, 2026, CVE-2026-21633 was publicly reported as a high-severity authentication bypass in the UniFi Protect Application's camera discovery protocol. The vulnerability allows unauthenticated attackers on the adjacent network to gain unauthorized access to UniFi Protect cameras.
Ubiquiti released UniFi Protect Application version 6.2.72 to fix vulnerabilities in the camera discovery protocol affecting version 6.1.79 and earlier, including CVE-2026-21633. The flaws could allow adjacent-network attackers to bypass authentication and access cameras, and also included CVE-2026-21634, a denial-of-service issue.
In May 2025, Ubiquiti disclosed CVE-2025-23123, a critical unauthenticated code execution vulnerability affecting UniFi Protect IP cameras via the management network. The issue was addressed in firmware version 4.75.62 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ubiquiti disclosed and patched two vulnerabilities in the **UniFi Network Application**, including **CVE-2026-22557**, a **critical path traversal flaw** with a **CVSS score of 10.0** that can be exploited by an unauthenticated attacker with network access. The flaw allows access to files on the underlying system, which can then be manipulated to gain access to an underlying account and potentially seize administrative control of the host. A second issue, **CVE-2026-22558**, is a **high-severity authenticated NoSQL injection vulnerability** rated **7.7** that can allow privilege escalation by attackers who already have valid access. Affected releases include **UniFi Network Application 10.1.85 and earlier, 10.2.93 and earlier, and 9.0.114 and earlier**. Ubiquiti says organizations should upgrade to **10.1.89 or later**, **10.2.97 or later**, or update **UniFi Express firmware to 4.0.13 or later**, which brings the application to **9.0.118 or later**. Reporting across the sources consistently describes the first flaw as enabling account takeover or full compromise of the underlying system, while the second provides a post-authentication escalation path; one source also notes the critical bug was reported by researcher **n00r3 (@izn0u)**, and another highlights asset discovery guidance for identifying exposed **Ubiquiti UniFi Network** deployments.
Jul 2, 2026
Ubiquiti released security updates for **UniFi OS** to fix five vulnerabilities affecting widely deployed products including **UniFi Cloud Gateway, UniFi Dream Machine, UNVR, NAS devices, consoles, and UniFi OS Server**. Three flaws—`CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`—were rated **CVSS 10.0** and could be exploited by remote, unauthenticated attackers to change system settings, read sensitive files through path traversal, or trigger command injection that could lead to remote code execution. Two additional issues, `CVE-2026-33000` and `CVE-2026-34911`, could also enable command injection, path traversal, privilege escalation, persistence, and data theft under certain conditions. The vulnerabilities were reported through **HackerOne**, and Ubiquiti said they can be exploited with low complexity, although it did not say whether they had been abused before patches were issued. Government and national CERT advisories, including Canada’s Cyber Centre and Germany’s dCERT, directed administrators to review Ubiquiti bulletin 064 and apply updated firmware and software versions immediately. The risk is amplified by the large number of Internet-exposed UniFi OS systems—reportedly close to **100,000**—because these appliances often sit at the network edge and can provide attackers with a path into internal environments if management interfaces are publicly reachable.
Jun 29, 2026
Ubiquiti disclosed two high-severity vulnerabilities affecting separate UniFi product lines, including a cross-site scripting issue in **UniFi Network Server** tracked as `CVE-2026-22559` and a path traversal flaw in **UniFi Play** tracked as `CVE-2026-22562`. The Network Server bug stems from improper input validation and can enable unauthorized account access if a user is socially engineered into clicking a malicious link. It affects **UniFi Network Server 10.1.85 and earlier**, with remediation available in **10.1.89 or later**. The more severe UniFi Play issue could let an attacker with access to the UniFi Play network write files to the device through path traversal, creating a path to remote code execution via malicious firmware file writes. Affected products include **UniFi Play PowerAmp 1.0.35 and earlier** and **UniFi Play Audio Port 1.0.24 and earlier**. Ubiquiti recommends upgrading PowerAmp to **1.0.38 or later** and Audio Port to **1.1.9 or later** to mitigate the exposure.
Jun 29, 2026