PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110456 Ubiquiti Inc CVE debrief

A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device. This medium-severity vulnerability affects UniFi Protect AI Key deployments, particularly those with network-accessible devices. Defenders should assess exposure and prioritize patching to prevent potential exploitation. The CVE record and UniFi Protect AI Key security advisory provide details on the vulnerability, but additional information on exploitation or affected systems is limited. Defenders responsible for UniFi Protect AI Key deployments should verify and apply the 2.2

Vendor
Ubiquiti Inc
Product
UniFi Protect AI Key
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for UniFi Protect AI Key deployments, especially those with network-accessible devices, should assess exposure and prioritize patching.

Why it matters

CVE-2026-110456 is a medium-severity Improper Access Control vulnerability in UniFi Protect AI Key. Defenders should prioritize patching and monitoring network access controls to prevent exploitation.

  • Verify and apply security patches for UniFi Protect AI Key versions less than 2.2.8.
  • Monitor network access controls to prevent exploitation.
  • Review inventory of UniFi Protect AI Key deployments.

Technical summary

CVE-2026-110456 is an Improper Access Control vulnerability in UniFi Protect AI Key, allowing a malicious actor with network access to access internal resources under certain conditions. The vulnerability affects versions less than 2.2.8 and has a CVSS score of 5.3, indicating medium severity. To address this vulnerability, defenders should prioritize verifying and applying the vendor's security patch for UniFi Protect AI Key, especially for versions less than 2.2.8, and monitor network access controls to prevent exploitation.

Defensive priority

Defenders should prioritize verifying and applying the vendor's security patch for UniFi Protect AI Key, especially for versions less than 2.2.8, and monitor network access controls.

Recommended defensive actions

  • Verify and apply the vendor's security patch for UniFi Protect AI Key, especially for versions less than 2.2.8.
  • Monitor network access controls to prevent exploitation.
  • Review and update inventory of UniFi Protect AI Key deployments.

Evidence notes

The CVE record and UniFi Protect AI Key security advisory provide details on the Improper Access Control vulnerability. However, additional information on exploitation or affected systems is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110456 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110456

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110456 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110456

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-110456

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110456.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://community.ui.com/releases/Security-Advisory-Bulletin-070-070/e7ffc9fa-9129-4a90-b5e3-d597c5ee7a73

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.