Loading story…
Ubiquiti disclosed and patched two vulnerabilities in the UniFi Network Application, including CVE-2026-22557, a critical path traversal flaw with a CVSS score of 10.0 that can be exploited by an unauthenticated attacker with network access. The flaw allows access to files on the underlying system, which can then be manipulated to gain access to an underlying account and potentially seize administrative control of the host. A second issue, CVE-2026-22558, is a high-severity authenticated NoSQL injection vulnerability rated 7.7 that can allow privilege escalation by attackers who already have valid access.
Affected releases include UniFi Network Application 10.1.85 and earlier, 10.2.93 and earlier, and 9.0.114 and earlier. Ubiquiti says organizations should upgrade to 10.1.89 or later, 10.2.97 or later, or update UniFi Express firmware to 4.0.13 or later, which brings the application to 9.0.118 or later. Reporting across the sources consistently describes the first flaw as enabling account takeover or full compromise of the underlying system, while the second provides a post-authentication escalation path; one source also notes the critical bug was reported by researcher n00r3 (@izn0u), and another highlights asset discovery guidance for identifying exposed Ubiquiti UniFi Network deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A high-severity path traversal vulnerability, CVE-2026-54406, was disclosed affecting self-hosted UniFi Network Application instances. The flaw can let a network-accessible attacker with high privileges escalate write permissions on the host device, and guidance recommended updating, restricting network access, and enforcing least privilege.
Following Ubiquiti's disclosure, public reporting and official advisories highlighted that CVE-2026-22557 could allow unauthenticated remote file access and possible takeover of the underlying system or account, while CVE-2026-22558 could enable privilege escalation. Administrators were urged to patch immediately and reduce exposure of internet-facing UniFi management interfaces.
Ubiquiti disclosed CVE-2026-22557, a critical/maximum-severity path traversal vulnerability, and CVE-2026-22558, a high-severity authenticated NoSQL injection flaw affecting multiple UniFi Network Application versions. The company released fixes and advised customers to upgrade to patched versions, including 10.1.89+, 10.2.97+, and UniFi Express firmware 4.0.13+ (app 9.0.118+).
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcebishopfox.com
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourceccb.belgium.be
Open sourcesecurityaffairs.com
Open sourcerunzero.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ubiquiti released security updates for **UniFi OS** to fix five vulnerabilities affecting widely deployed products including **UniFi Cloud Gateway, UniFi Dream Machine, UNVR, NAS devices, consoles, and UniFi OS Server**. Three flaws—`CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`—were rated **CVSS 10.0** and could be exploited by remote, unauthenticated attackers to change system settings, read sensitive files through path traversal, or trigger command injection that could lead to remote code execution. Two additional issues, `CVE-2026-33000` and `CVE-2026-34911`, could also enable command injection, path traversal, privilege escalation, persistence, and data theft under certain conditions. The vulnerabilities were reported through **HackerOne**, and Ubiquiti said they can be exploited with low complexity, although it did not say whether they had been abused before patches were issued. Government and national CERT advisories, including Canada’s Cyber Centre and Germany’s dCERT, directed administrators to review Ubiquiti bulletin 064 and apply updated firmware and software versions immediately. The risk is amplified by the large number of Internet-exposed UniFi OS systems—reportedly close to **100,000**—because these appliances often sit at the network edge and can provide attackers with a path into internal environments if management interfaces are publicly reachable.
Jun 29, 2026
Ubiquiti disclosed two high-severity vulnerabilities affecting separate UniFi product lines, including a cross-site scripting issue in **UniFi Network Server** tracked as `CVE-2026-22559` and a path traversal flaw in **UniFi Play** tracked as `CVE-2026-22562`. The Network Server bug stems from improper input validation and can enable unauthorized account access if a user is socially engineered into clicking a malicious link. It affects **UniFi Network Server 10.1.85 and earlier**, with remediation available in **10.1.89 or later**. The more severe UniFi Play issue could let an attacker with access to the UniFi Play network write files to the device through path traversal, creating a path to remote code execution via malicious firmware file writes. Affected products include **UniFi Play PowerAmp 1.0.35 and earlier** and **UniFi Play Audio Port 1.0.24 and earlier**. Ubiquiti recommends upgrading PowerAmp to **1.0.38 or later** and Audio Port to **1.1.9 or later** to mitigate the exposure.
Jun 29, 2026
Ubiquiti disclosed two significant vulnerabilities in its UniFi Protect Application, affecting versions 6.1.79 and earlier. The first, CVE-2026-21633, is an improper authentication vulnerability in the discovery protocol that allows a network-adjacent, unauthenticated attacker to gain unauthorized access to UniFi Protect cameras. The second, CVE-2026-21634, is a buffer overflow vulnerability in the same protocol, which can be exploited to cause a denial-of-service (DoS) condition by restarting the application. Both vulnerabilities require the attacker to be on the same network segment as the target device. The vulnerabilities have been rated high (CVSS 8.8) and medium (CVSS 6.5) respectively, and users are strongly advised to upgrade to UniFi Protect Application version 6.2.72 or later to mitigate the risks. Exploitation of these flaws could result in unauthorized surveillance access or disruption of video management services. Asset discovery tools can be used to identify potentially vulnerable systems within an organization’s network for prompt remediation.
Jun 29, 2026