Loading story…
Ubiquiti released patches for two vulnerabilities in the UniFi Network Application (also known as the UniFi Controller), including CVE-2026-22557, a critical path traversal flaw rated CVSS 10.0. The vulnerability could allow an unauthenticated attacker with network access to read files from the target system and potentially compromise accounts without user interaction. A second issue, CVE-2026-22558, is an authenticated NoSQL injection vulnerability that could be used for privilege escalation.
Affected versions include UniFi Network Application 10.1.85 and earlier, release candidate 10.2.93 and earlier, and UniFi Express builds running 9.0.114 and earlier. Ubiquiti said the issues are fixed in UniFi Network Application 10.1.89 or later, 10.2.97 or later for the release candidate, and UniFi Express firmware 4.0.13 or later with UniFi Network Application 9.0.118 or later. Singapore's Cyber Security Agency urged administrators to update to the latest version immediately.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Ubiquiti disclosed and fixed two vulnerabilities in the UniFi Network Application: CVE-2026-22557, a critical path traversal flaw, and CVE-2026-22558, an authenticated NoSQL injection privilege-escalation issue. Recommended fixed versions included UniFi Network Application 10.1.89 or later, 10.2.97 or later for the release candidate, and UniFi Express firmware 4.0.13 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
csa.gov.sg
Open sourcetruesec.com
Open sourcecensys.com
Open sourcecommunity.ui.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ubiquiti disclosed and patched two vulnerabilities in the **UniFi Network Application**, including **CVE-2026-22557**, a **critical path traversal flaw** with a **CVSS score of 10.0** that can be exploited by an unauthenticated attacker with network access. The flaw allows access to files on the underlying system, which can then be manipulated to gain access to an underlying account and potentially seize administrative control of the host. A second issue, **CVE-2026-22558**, is a **high-severity authenticated NoSQL injection vulnerability** rated **7.7** that can allow privilege escalation by attackers who already have valid access. Affected releases include **UniFi Network Application 10.1.85 and earlier, 10.2.93 and earlier, and 9.0.114 and earlier**. Ubiquiti says organizations should upgrade to **10.1.89 or later**, **10.2.97 or later**, or update **UniFi Express firmware to 4.0.13 or later**, which brings the application to **9.0.118 or later**. Reporting across the sources consistently describes the first flaw as enabling account takeover or full compromise of the underlying system, while the second provides a post-authentication escalation path; one source also notes the critical bug was reported by researcher **n00r3 (@izn0u)**, and another highlights asset discovery guidance for identifying exposed **Ubiquiti UniFi Network** deployments.
Jul 2, 2026
Ubiquiti released security updates for **UniFi OS** to fix five vulnerabilities affecting widely deployed products including **UniFi Cloud Gateway, UniFi Dream Machine, UNVR, NAS devices, consoles, and UniFi OS Server**. Three flaws—`CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`—were rated **CVSS 10.0** and could be exploited by remote, unauthenticated attackers to change system settings, read sensitive files through path traversal, or trigger command injection that could lead to remote code execution. Two additional issues, `CVE-2026-33000` and `CVE-2026-34911`, could also enable command injection, path traversal, privilege escalation, persistence, and data theft under certain conditions. The vulnerabilities were reported through **HackerOne**, and Ubiquiti said they can be exploited with low complexity, although it did not say whether they had been abused before patches were issued. Government and national CERT advisories, including Canada’s Cyber Centre and Germany’s dCERT, directed administrators to review Ubiquiti bulletin 064 and apply updated firmware and software versions immediately. The risk is amplified by the large number of Internet-exposed UniFi OS systems—reportedly close to **100,000**—because these appliances often sit at the network edge and can provide attackers with a path into internal environments if management interfaces are publicly reachable.
Jun 29, 2026
Multiple critical vulnerabilities in **Ubiquiti UniFi OS** can be chained to give an unauthenticated attacker **remote code execution as root** on exposed devices. Fortinet reported active in-the-wild exploitation of an exploit chain involving `CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`, combining authentication bypass, path traversal, access to protected resources, and arbitrary command execution. Researchers have publicly demonstrated the chain, raising the risk for organizations that use UniFi OS to manage gateways, network controllers, video surveillance, and access control systems. `CVE-2026-34909` is described as a **CVSS 10.0** path traversal flaw that can expose sensitive files and enable account compromise, while `CVE-2026-34910` is a **CVSS 10.0** command injection bug affecting a wide range of UniFi hardware and the software-only **UniFi OS Server**. Ubiquiti addressed the issues in **Security Advisory Bulletin 064** with firmware updates across product families, including **UniFi OS 5.1.12** for many devices and other fixed releases for NAS, UDM Beast, and UniFi OS Server platforms. Defenders are being urged to patch immediately, limit management interfaces to trusted networks, review internet-exposed systems for compromise, and perform integrity checks because persistence may remain after remediation.
Aug 15, 2026