Loading vulnerability…
CORS Misconfiguration in UniFi OS
CVE-2026-55110 is a Cross-Origin Resource Sharing (CORS) misconfiguration in UniFi OS affecting versions 5.1.15 through 5.1.18 and earlier on affected platforms, including UDM, UNVR, UNAS, and related UniFi OS deployments. The flaw allows a remote, unauthenticated attacker to induce a victim who is already authenticated to UniFi OS to visit a malicious webpage, after which the attacker can cause the victim’s browser to issue cross-origin requests that are accepted by UniFi OS and executed within the context of the victim’s active session. The vulnerability is caused by improper CORS policy enforcement that permits unauthorized cross-origin interaction with privileged application functionality.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to trigger operations in UniFi OS as the authenticated victim user. Impact depends on the victim’s privileges and the reachable application functionality, but can include unauthorized administrative or configuration actions, misuse of management features, and compromise of integrity within the UniFi OS instance or device. The issue does not require direct authentication by the attacker, but it does rely on abuse of an existing authenticated session in the victim’s browser.
If you can’t patch tonight, do this now.
No interim workaround information is available. Until patched versions can be deployed, reduce exposure by limiting access to UniFi OS management interfaces, enforcing administrative session hygiene, logging out of management sessions when not in use, and minimizing the likelihood that authenticated administrators browse untrusted websites from the same browser session used to access UniFi OS.
Patch, then assume compromise.
Upgrade affected UniFi OS platforms to version 5.1.19 or later. Vendor guidance indicates patched releases are available in UniFi OS 5.1.19+ for affected platforms.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.