CVE-2026-22557: 
Ubiquiti UniFi vulnerability analysis and mitigation

CVE-2026-22557 is a critical path traversal vulnerability in the Ubiquiti UniFi Network Application that allows an unauthenticated network-adjacent attacker to access sensitive files on the underlying system and manipulate them to gain unauthorized access to system accounts. Disclosed on March 19, 2026, the vulnerability affects UniFi Network Application versions prior to 9.0.118, 10.1.89, and 10.2.97. It carries a CVSS v3.1 base score of 10.0 (Critical), reflecting its network-accessible, no-authentication-required, and scope-changed characteristics (Ubiquiti Advisory, ENISA EUVD).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'), where the UniFi Network Application fails to properly sanitize user-supplied path components in network requests. An attacker with network access can craft requests using path traversal sequences (e.g., ../) to escape the application's intended directory scope and read or manipulate arbitrary files on the host system. The attack requires no authentication, no user interaction, and has low complexity, making it trivially exploitable from any network-accessible position. Exploitation can lead to manipulation of files that control account access, enabling full account takeover. Related attack patterns include CAPEC-126 (Path Traversal), CAPEC-64 (URL Encoding Bypass), and CAPEC-76 (Manipulating Web Input to File System Calls) (Ubiquiti Advisory, Bishop Fox Blog).

Successful exploitation grants an unauthenticated attacker the ability to read and manipulate sensitive files on the system hosting the UniFi Network Application, with the primary consequence being unauthorized access to underlying system accounts — effectively a full account takeover. The CVSS scope is marked as 'Changed,' indicating that exploitation can impact resources beyond the vulnerable component itself, including the broader network infrastructure managed by the UniFi controller. Given that UniFi controllers often manage enterprise and SMB network infrastructure (switches, access points, gateways), a compromised controller could enable lateral movement across the managed network, configuration tampering, and persistent access (Ubiquiti Advisory, BleepingComputer).

As of the time of reporting, no confirmed working exploit has been publicly released, though detection-oriented tooling and a PoC repository have appeared on GitHub (GitHub Detection Repo, GitHub PoC). Bishop Fox published a technical blog and a check tool in late May 2026, indicating active research into weaponization (Bishop Fox Blog, Bishop Fox Check Tool). There is no confirmed in-the-wild exploitation or CISA KEV catalog listing at this time. The EPSS score is approximately 0.047%, reflecting low but non-zero probability of near-term exploitation. The vulnerability's maximum CVSS score and zero-authentication requirement make it a high-priority patching target regardless of current exploitation status.

1. Reconnaissance: Use tools like Shodan, Censys, or runZero to identify internet-facing or network-accessible UniFi Network Application instances running versions prior to 9.0.118, 10.1.89, or 10.2.97. The application typically listens on TCP port 8443 (HTTPS) or 8080 (HTTP).
2. Identify vulnerable endpoint: Probe the application's HTTP/HTTPS interface for endpoints that accept file path parameters or resource identifiers without authentication.
3. Craft path traversal payload: Construct an HTTP request containing path traversal sequences (e.g., ../../, URL-encoded variants such as %2e%2e%2f, or alternate encodings) targeting sensitive system files such as credential stores, configuration files, or account databases used by the UniFi application.
4. Access sensitive files: Send the crafted request to the vulnerable endpoint. If successful, the server returns the contents of the targeted file outside the application's intended directory scope.
5. Manipulate account files: Identify and modify files that control account credentials or access (e.g., admin password hashes, session tokens, or configuration files) to inject attacker-controlled credentials or escalate privileges.
6. Achieve account takeover: Use the manipulated credentials or session data to authenticate to the UniFi Network Application as an administrator, gaining full control over the managed network infrastructure (Bishop Fox Blog, Ubiquiti Advisory).

• Network: Unusual HTTP/HTTPS requests to the UniFi Network Application (ports 8443/8080) containing path traversal sequences (../, %2e%2e%2f, %2e%2e/, ..%2f) in URL paths or parameters; unexpected outbound connections from the UniFi server to unknown external IPs.
• Logs: UniFi application access logs showing repeated requests to file-serving endpoints with encoded or anomalous path components; HTTP 200 responses to requests containing traversal sequences; authentication events from unexpected IP addresses or at unusual times following file access anomalies.
• File System: Unexpected modifications to UniFi configuration files, credential stores, or account databases (e.g., files under the UniFi data directory such as data/db/ or data/keystore); new or modified admin account entries in the MongoDB database backing the UniFi application.
• Process: Unexpected processes spawned by the UniFi application service account; unusual database query activity against the UniFi MongoDB instance.
• Detection Tools: The community detection script at https://github.com/GarethMSheldon/cve-2026-22557-unifi-detection includes YARA rules, Sigma rules, KQL queries, and Splunk SPL for identifying vulnerable systems and potential exploitation indicators (GitHub Detection Repo).

Ubiquiti has released patched versions of the UniFi Network Application: 9.0.118, 10.1.89, and 10.2.97 — users should upgrade to one of these versions immediately (Ubiquiti Advisory). As an interim workaround, restrict network access to the UniFi Network Application to trusted networks only using firewall rules or network segmentation, preventing untrusted hosts from reaching the management interface. Implement monitoring for path traversal patterns in application logs and review admin account activity for unauthorized changes. The Singapore CSA and Belgian CCB have both issued advisories urging immediate patching (CSA Advisory, CCB Advisory).

The vulnerability generated significant community attention given its maximum CVSS score of 10.0. Reddit communities (r/UNIFI, r/msp, r/sysadmin) quickly circulated PSA posts urging users to update their UniFi Network Applications, with one thread noting the rarity of a 10.0 CVE in this product line (Reddit r/UNIFI). Security media including BleepingComputer, CyberScoop, SecurityAffairs, Heise, and CyberSecurityNews covered the disclosure prominently (BleepingComputer, CyberScoop). Bishop Fox published a detailed technical analysis titled 'Looting UniFi Controllers: Detecting and Weaponizing CVE-2026-22557' in late May 2026, elevating researcher interest in the vulnerability's exploitation potential (Bishop Fox Blog). National CERTs including Ireland's NCSC and Singapore's CSA issued formal advisories, reflecting the vulnerability's broad impact on enterprise and SMB network infrastructure.