CVE-2026-55114: 
Ubiquiti UniFi vulnerability analysis and mitigation

CVE-2026-55114 is an Improper Access Control vulnerability (CWE-284) in Ubiquiti's UniFi Network Application that allows a low-privileged network attacker to escalate privileges within the application. It affects all versions of UniFi Network Application prior to 10.4.57, and was published on July 2, 2026. The vulnerability was assigned by HackerOne and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Ubiquiti Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control), meaning the UniFi Network Application fails to properly restrict access to privileged resources or functions for authenticated low-privilege users. An attacker with network access and a low-privilege account can exploit this flaw to elevate their permissions within the application without requiring user interaction or elevated complexity. The attack vector is network-based, requires low privileges, and has low attack complexity, making it straightforward to exploit once an attacker has any valid account on the system (GitHub Advisory, Ubiquiti Advisory).

Successful exploitation results in full compromise of confidentiality, integrity, and availability within the UniFi Network Application, as reflected by the High ratings across all three impact dimensions in the CVSS score. A low-privileged attacker who escalates privileges could gain administrative control over the network management application, potentially enabling unauthorized configuration changes, access to sensitive network data, and disruption of managed network infrastructure. Given that UniFi Network Application is widely used to manage enterprise and prosumer network equipment, privilege escalation could facilitate lateral movement across managed network segments (GitHub Advisory, Ubiquiti Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the attack is not automatable. The EPSS score is approximately 0.232%, placing it in the 14th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

Ubiquiti has released UniFi Network Application version 10.4.57 to address this vulnerability; all users should upgrade immediately (Ubiquiti Advisory). As interim mitigations, administrators should restrict network access to the UniFi Network Application to only authorized and trusted users, implement network segmentation to limit exposure, and audit existing user privilege assignments within the application to identify any unauthorized escalation. Monitoring application logs for unexpected privilege changes or access to administrative functions by low-privilege accounts is also recommended.

CVE-2026-55114 was part of a broader disclosure by Ubiquiti covering 25 security vulnerabilities across the UniFi ecosystem, which received coverage from cybersecurity news outlets including Cybersecurity News and Cryptika (Cybersecurity News, Cryptika). Field Effect also published analysis noting Ubiquiti's patching of multiple critical vulnerabilities in UniFi products (Field Effect). No notable individual researcher commentary or significant social media controversy has been identified for this specific CVE.