Loading vulnerability…
Privilege Escalation in UniFi Access Application
CVE-2026-54400 is a critical improper access control vulnerability in the UniFi Access Application. The flaw affects UniFi Access versions 4.2.28 and earlier and allows a malicious actor who already has network access and high privileges within the application context to further escalate privileges on the underlying host device. Available information identifies the issue as an access control failure but does not provide the specific vulnerable component, function, or code path. The vulnerability is remotely exploitable over the network, requires no user interaction, and has been assigned a CVSS v3.1 score of 9.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows privilege escalation on the affected host device. Because the CVSS assessment indicates high impacts to confidentiality, integrity, and availability, exploitation could enable an attacker to obtain broader control over the host, access sensitive data, alter system state or security settings, and disrupt normal operation of the device or application environment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network exposure to the UniFi Access Application, limit access to trusted administrative networks and users only, and review and enforce access-control assignments to minimize the number of accounts with high privileges. Monitor administrative activity closely until the update can be applied.
Patch, then assume compromise.
Upgrade UniFi Access Application to version 4.2.29 or later, which contains the vendor fix for this vulnerability. Prioritize patching all deployments running version 4.2.28 and earlier.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.