CVE-2026-110458 Ubiquiti Inc CVE debrief

Who should care

Defenders responsible for UniFi Protect AI Key devices should assess exposure and prioritize verification and updates to prevent exploitation of the Path Traversal vulnerability. This includes reviewing the CVE record and UniFi Protect AI Key security advisory bulletin to understand the vulnerability and its potential impact. Additionally, defenders should verify and update affected devices to version 2.2.8 or later,

Why it matters

Defenders should prioritize verifying and updating UniFi Protect AI Key to prevent exploitation of the Path Traversal vulnerability.

• Verify and update UniFi Protect AI Key to version 2.2.8 or later to prevent exploitation
• Restrict network access to UniFi Protect AI Key to reduce attack surface

Technical summary

A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device. This vulnerability is significant because it could be exploited by an attacker to modify files on the device, potentially leading to unauthorized access or disruption of service. The vulnerability is identified as CVE-2026-110458, and it affects UniFi Protect AI Key devices.

Defensive priority

Defenders should prioritize verifying and updating UniFi Protect AI Key to version 2.2.8 or later, and restrict network access to the device.

Recommended defensive actions

• Verify UniFi Protect AI Key version and update to 2.2.8 or later
• Restrict network access to UniFi Protect AI Key
• Monitor UniFi Protect AI Key for suspicious activity

Evidence notes

The CVE record and UniFi Protect AI Key security advisory bulletin provide details on the Path Traversal vulnerability. The vulnerability is identified as CVE-2026-110458, and it affects UniFi Protect AI Key devices. The CVE record provides source-provided CVE metadata, while the UniFi Protect AI Key security advisory bulletin offers guidance on verifying and updating affected devices. Defenders should review these sources to understand the vulnerability and its potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.