Loading vulnerability…
SSRF Privilege Escalation in UniFi Protect Application
CVE-2026-55115 is a critical server-side request forgery vulnerability in the UniFi Protect Application. The flaw affects UniFi Protect version 7.1.77 and earlier and can be exploited by an attacker who has network access to the target environment and low privileges within the application context. Successful exploitation allows the attacker to coerce the application into making unintended server-side requests, resulting in privilege escalation on the host device. Available reporting consistently characterizes the issue as remotely exploitable, low complexity, and requiring no user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow privilege escalation on the host device from a low-privileged starting position. Because the vulnerability is rated critical with high confidentiality, integrity, and availability impact and changed scope, exploitation may enable broad compromise of the affected system, including unauthorized access to protected resources, modification of system or application state, and disruption of normal device operation.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting network access to UniFi Protect management interfaces and application services, limiting access to trusted administrative networks and principals only, and applying network segmentation to prevent untrusted or low-privileged users from reaching the vulnerable service. Additional defensive measures include hardening server-side request handling and validating or sanitizing user-supplied input where feasible. No interim vendor workaround is currently available.
Patch, then assume compromise.
Upgrade UniFi Protect Application to version 7.1.83 or later. Versions 7.1.77 and earlier are affected. No more specific code-level remediation details are currently available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.