CVE-2026-54400 Ubiquiti Inc CVE debrief

Who should care

Administrators and users of UniFi Access Application should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The vulnerability is caused by an Improper Access Control issue in UniFi Access Application. This allows an attacker with high privileges and network access to escalate privileges on the host device. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The vulnerability has a CVSS score of 9.1 and is categorized as CRITICAL.

Defensive priority

High priority should be given to patching or mitigating this vulnerability as it allows for privilege escalation and has a high CVSS score.

Recommended defensive actions

• Apply the patch or update to version 4.2.29 or later
• Restrict access to the UniFi Access Application
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-02T15:17:03.623Z and was last modified on 2026-07-09T13:21:25.470Z. The NVD entry is currently Analyzed. The vulnerability is categorized as CRITICAL with a CVSS score of 9.1. Evidence from the CVE record and NVD entry indicates that the vulnerability is caused by an Improper Access Control issue in UniFi Access Application. This allows an attacker with high privileges and network access to escalate privileges on the host device.

Official resources