PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110455 Ubiquiti Inc CVE debrief

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device. This vulnerability, identified as CVE-2026-110455, has a high severity rating and requires immediate attention from defenders. The vulnerability allows for command injection under specific conditions, posing a significant risk to UniFi Protect AI Key devices. Defenders should assess exposure and prioritize remediation efforts to prevent potential attacks. The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or

Vendor
Ubiquiti Inc
Product
UniFi Protect AI Key
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for UniFi Protect AI Key devices, network administrators, and security teams should assess exposure and prioritize remediation.

Why it matters

CVE-2026-110455 is a high-severity vulnerability in UniFi Protect AI Key that allows for command injection under certain conditions. Defenders should prioritize verifying and remediating vulnerable devices to prevent potential attacks.

  • Verify and remediate vulnerable UniFi Protect AI Key devices to prevent command injection attacks.
  • Monitor network activity for potential command injection attempts.
  • Assess exposure of UniFi Protect AI Key devices with versions less than 2.2.8.

Technical summary

CVE-2026-110455 is an Improper Input Validation vulnerability in UniFi Protect AI Key, allowing for command injection under certain conditions. This vulnerability has a high severity rating and affects UniFi Protect AI Key devices with versions less than 2.2.8. The vulnerability allows an attacker to execute a Command Injection on the device, posing a significant risk to defenders. Defenders should prioritize verifying and remediating vulnerable devices to prevent potential attacks. The CVE record and source item provide details on the vulnerability, but limited

Defensive priority

Defenders should prioritize verifying and remediating UniFi Protect AI Key devices with versions less than 2.2.8, as they may be vulnerable to command injection attacks.

Recommended defensive actions

  • Verify UniFi Protect AI Key devices with versions less than 2.2.8 and assess exposure.
  • Remediate vulnerable UniFi Protect AI Key devices to version 2.2.8 or later.
  • Monitor network activity for potential command injection attempts.

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or affected versions beyond 2.2.8.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110455 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110455

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110455 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110455

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-110455

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110455.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://community.ui.com/releases/Security-Advisory-Bulletin-070-070/e7ffc9fa-9129-4a90-b5e3-d597c5ee7a73

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.