CVE-2026-55118: 
Ubiquiti UniFi vulnerability analysis and mitigation

CVE-2026-55118 is an Improper Access Control vulnerability (CWE-284) in Ubiquiti's UniFi Network Application that allows a low-privileged, authenticated network user to escalate privileges within the application. It affects all versions of UniFi Network Application prior to 10.4.57. The vulnerability was published on July 2, 2026, and a patch was made available the same day. It carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory, Ubiquiti Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control), meaning the application fails to properly restrict access to privileged resources or functions for authenticated users with low-level permissions. An attacker with network access and low privileges can exploit this flaw under certain conditions to elevate their role within the UniFi Network Application, potentially gaining administrative capabilities. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it relatively straightforward to exploit once an attacker has a valid low-privileged account. No public proof-of-concept or detailed technical write-up has been disclosed as of the time of reporting (GitHub Advisory, Ubiquiti Advisory).

Successful exploitation allows a low-privileged authenticated user to escalate their privileges within the UniFi Network Application, potentially gaining administrative control over network infrastructure managed by the application. The CVSS scoring reflects high integrity and availability impact alongside low confidentiality impact, meaning an attacker could modify network configurations, disrupt services, or perform unauthorized administrative actions. This could affect all devices and network segments managed through the UniFi Network Application, posing a significant risk in enterprise or multi-tenant deployments (GitHub Advisory, Ubiquiti Advisory).

As of the time of reporting, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The EPSS score is approximately 0.195%, indicating a low near-term probability of exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Ubiquiti Advisory).

Ubiquiti has released UniFi Network Application version 10.4.57, which addresses this vulnerability. All users running versions prior to 10.4.57 should upgrade immediately. As an interim measure, administrators should restrict network access to the UniFi Network Application management interface to trusted users and networks only, and monitor application logs for unauthorized privilege escalation attempts (Ubiquiti Advisory, GitHub Advisory).

Coverage of this vulnerability appeared in the context of a broader Ubiquiti disclosure of 25 security vulnerabilities across the UniFi ecosystem, which attracted attention from cybersecurity news outlets and community blogs. CyberSecurityNews and Cryptika reported on the batch disclosure, noting the scope of the UniFi product security issues. No notable individual researcher commentary or significant social media debate specific to CVE-2026-55118 has been identified (CyberSecurityNews, Cryptika).