Loading vulnerability…
Path Traversal in UniFi Network Application
CVE-2026-54406 is a high-severity path traversal vulnerability affecting self-hosted instances of the UniFi Network Application. The flaw allows a malicious actor with network access and high privileges to exploit improper path handling and escalate write permissions on the underlying host device. Publicly available details identify the issue as remotely exploitable and affecting UniFi Network Application version 10.3.58 and earlier, with fixes available in 10.4.57 and later. Successful exploitation extends an attacker’s ability beyond the intended application boundary and enables unauthorized modification capability on the host system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker who already has high privileges within the application context and network reachability to gain expanded write capability on the host device. This can undermine host integrity, enable unauthorized modification of files accessible through the escalated write path, and create conditions for further compromise, persistence, or follow-on privilege escalation depending on host configuration and available writable targets.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by strictly limiting network access to the management interface and application services to authorized administrative networks and users only, and enforce least-privilege assignment for all accounts to minimize the number of principals capable of meeting the exploitation prerequisites. Additional hardening of the host and close monitoring for unauthorized file modification may reduce risk, but patching remains the primary mitigation.
Patch, then assume compromise.
Upgrade self-hosted UniFi Network Application deployments to version 10.4.57 or later. Because no interim vendor workaround is identified, remediation should prioritize prompt patching of all affected self-hosted instances and verification that older vulnerable releases, including 10.3.58 and earlier, are no longer in service.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.