Loading vulnerability…
Authenticated SQL Injection Privilege Escalation in UniFi OS
CVE-2026-54404 is a high-severity series of authenticated SQL injection vulnerabilities in UniFi OS. The flaws are remotely exploitable by an attacker who already has low-privileged access and network reachability to the target UniFi OS device or instance. Successful exploitation allows manipulation of backend SQL queries in a way that results in privilege escalation within the affected UniFi OS environment. Reported affected versions include UniFi OS / Server 5.1.15 and earlier, UniFi Network Attached Storage 5.1.16 and earlier, and EF-Core 5.1.18 and earlier.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow a low-privileged attacker to escalate privileges within the affected UniFi OS device or instance. The reported security impact is high across confidentiality, integrity, and availability, indicating the attacker may gain access to sensitive data, perform unauthorized administrative actions or configuration changes, and potentially disrupt normal operation of the device or hosted services.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network access to UniFi OS management interfaces and services to only trusted administrative networks, minimize the number of accounts with access, enforce least privilege for all UniFi OS users, and closely monitor authentication, administrative, and database-related activity for signs of exploitation. No interim workaround has been reported as a complete substitute for vendor patches.
Patch, then assume compromise.
Upgrade affected platforms to a fixed UniFi OS release. Reported vendor guidance recommends updating UniFi OS to version 5.1.19 or later. Where applicable, update affected related platforms and deployments to the corresponding patched releases provided by the vendor.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.