PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54400 Ubiquiti Inc CVE debrief

CVE-2026-54400 is a CRITICAL Improper Access Control vulnerability in UniFi Access Application. A malicious actor with access to the network and high privileges could exploit this vulnerability to escalate privileges on the host device. The vulnerability has a CVSS score of 9.1. The vulnerability is caused by an Improper Access Control issue in UniFi Access Application, allowing an attacker with high privileges and network access to escalate privileges on the host device. Administrators and users of UniFi Access Application should be aware of this vulnerability and take necessary actions to mitigate it.

Vendor
Ubiquiti Inc
Product
UniFi Access Application
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-02
Original CVE updated
2026-08-17
Advisory published
2026-07-02
Advisory updated
2026-08-17

Who should care

Administrators and users of UniFi Access Application should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The vulnerability is caused by an Improper Access Control issue in UniFi Access Application. This allows an attacker with high privileges and network access to escalate privileges on the host device. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The vulnerability has a CVSS score of 9.1 and is categorized as CRITICAL.

Defensive priority

High priority should be given to patching or mitigating this vulnerability as it allows for privilege escalation and has a high CVSS score.

Recommended defensive actions

  • Apply the patch or update to version 4.2.29 or later
  • Restrict access to the UniFi Access Application
  • Monitor for suspicious activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-02T15:17:03.623Z and was last modified on 2026-07-09T13:21:25.470Z. The NVD entry is currently Analyzed. The vulnerability is categorized as CRITICAL with a CVSS score of 9.1. Evidence from the CVE record and NVD entry indicates that the vulnerability is caused by an Improper Access Control issue in UniFi Access Application. This allows an attacker with high privileges and network access to escalate privileges on the host device.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54400 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54400

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54400 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54400

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.