CVE-2026-110459 Ubiquiti Inc CVE debrief

Who should care

Defenders responsible for UniFi Protect AI Key devices, especially those with network access, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-110459 is a high-severity vulnerability in UniFi Protect AI Key that allows for information disclosure, unauthorized changes, and Denial of Service attacks. Defenders should prioritize verifying exposure, especially for devices with network access, and assess the need for updates or compensating controls.

• Information disclosure due to Improper Access Control
• Potential for unauthorized changes to device configuration
• Denial of Service attacks against UniFi Protect AI Key devices
• Need for verification of affected versions and exposure

Technical summary

CVE-2026-110459 is an Improper Access Control vulnerability in UniFi Protect AI Key, allowing malicious actors with network access to obtain information, make unauthorized changes, and execute Denial of Service attacks. This vulnerability has a high CVSS score of 8.6 and is considered a high-severity vulnerability. Defenders should prioritize verifying exposure of UniFi Protect AI Key devices, especially those with network access, and assess the need for updates or compensating controls.

Defensive priority

Defenders should prioritize verifying exposure of UniFi Protect AI Key devices, especially those with network access, and assess the need for updates or compensating controls.

Recommended defensive actions

• Verify exposure of UniFi Protect AI Key devices, especially those with network access
• Assess the need for updates or compensating controls
• Monitor for suspicious activity on affected devices

Evidence notes

The CVE record and UniFi Protect AI Key security advisory provide details on the Improper Access Control vulnerability. The vulnerability allows malicious actors with network access to obtain information, make unauthorized changes, and execute Denial of Service attacks. Defenders should verify exposure of affected devices, assess the need for updates or compensating controls, and monitor for suspicious activity. The CVE record was published on 2026-10-14T05:19:10.065Z and has not been

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.