Loading vulnerability…
Improper Access Control in Ubiquiti UniFi OS
CVE-2026-55116 is a critical improper access control vulnerability in certain devices running Ubiquiti UniFi OS. Under specific network configurations, a remote attacker with network access can exploit insufficient authorization controls to make unauthorized changes to affected UniFi OS devices. Reported affected versions include UniFi OS 5.1.15 and earlier on multiple UniFi OS platforms, with some reporting also noting exposure across related gateway and console hardware families. The flaw is described as remotely exploitable and enables unauthorized modification of device state or configuration without intended access restrictions being properly enforced.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to make unauthorized changes to affected UniFi OS devices. This can compromise system integrity by altering configuration or administrative state and may also affect confidentiality and availability depending on what changes are made. Available scoring information indicates high impact across confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network exposure to management interfaces and UniFi OS services, limit access to trusted administrative networks, review and harden access control settings, and monitor devices for unauthorized configuration or administrative changes. No interim workaround has been identified in some reporting, so patching should be prioritized.
Patch, then assume compromise.
Upgrade affected UniFi OS devices to UniFi OS 5.1.19 or later. More broadly, apply the vendor's fixed releases across impacted UniFi platforms and ensure all UniFi OS instances are updated to the latest supported version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.