These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-55119 is an Improper Access Control vulnerability in UniFi Talk Application. A malicious actor with access to the network and low privileges could exploit this vulnerability to escalate privileges within the UniFi Talk Application. The vulnerability has a CVSS score of 8.1 and is classified as HIGH severity. The vulnerability affects UniFi Talk Application and has a significant impact on security [truncated]
A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices. This critical vulnerability, CVE-2026-55116, has a CVSS score of 9 and is classified as CRITICAL. The vulnerability affects certain devices running UniFi OS, and security [truncated]
A Server-Side Request Forgery (SSRF) vulnerability was found in the UniFi Talk Application. This vulnerability could allow a malicious actor with network access to execute a Denial of Service (DoS) attack and bypass authentication in certain UniFi Talk API endpoints. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. The affected product is the UniFi Talk Application, and the vu [truncated]
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability in UniFi OS with UniFi Protect Application to escalate privileges on the host device. This vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. The vulnerability allows for potential privilege escalation under certain conditions. Defenders should prioritize patching U [truncated]
A Path Traversal vulnerability was found in UniFi Protect Floodlight devices. This vulnerability allows a malicious actor with access to the network to exploit the vulnerability and access files on the UniFi Protect Floodlight. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. Security teams and administrators should be aware of this vulnerability and take necessary actions to mitigate it.
CVE-2026-55110 is a high-severity vulnerability in UniFi OS due to a Cross-Origin Resource Sharing (CORS) misconfiguration. An attacker could exploit this by luring an authenticated user to a malicious page to trigger actions in UniFi OS using that user's session. The vulnerability has a CVSS score of 7.5 and is classified as HIGH. This vulnerability affects UniFi OS Server, particularly those using versi [truncated]
CVE-2026-54409 is an Improper Initialization vulnerability in UniFi Protect Application. A malicious actor with access to the network and under certain conditions could exploit this vulnerability to bypass authentication in UniFi Protect Cameras. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. The vulnerability's impact is significant as it allows an attacker to bypass authen [truncated]
CVE-2026-54408 is an Improper Access Control vulnerability in UniFi Protect Application. A malicious actor with access to the network could exploit this vulnerability to bypass authentication for data streaming. The vulnerability has a high CVSS score of 8.6 and is considered HIGH severity. The vulnerability allows a malicious actor with network access to bypass authentication for data streaming. This cou [truncated]
CVE-2026-54404 is an authenticated SQL injection vulnerability in UniFi OS. A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances. The vulnerability has a CVSS score of 8.8 and a severity of HIGH. Administrators and users of UniFi OS devices or [truncated]
CVE-2026-54403 is a Path Traversal vulnerability found in certain devices running UniFi OS. A malicious actor with access to the network could exploit this vulnerability to bypass authentication of such UniFi OS devices or instances. The CVE record was published on 2026-07-02T15:17:03.947Z and has not been modified since then. The NVD entry is currently Analyzed.
CVE-2026-54402 is an Improper Input Validation vulnerability in UniFi OS. A malicious actor with access to the network and low privileges could exploit this vulnerability to execute a Command Injection on the host device. The vulnerability has a CVSS score of 9.9 and is classified as CRITICAL. Administrators and users of UniFi OS Server, particularly those with low privileges and network access, should pr [truncated]
CVE-2026-54401 is a Server-Side Request Forgery (SSRF) vulnerability in UniFi OS devices or instances. An attacker with network access and low privileges could exploit this vulnerability to escalate privileges. The vulnerability has a CVSS score of 7.7 and is classified as HIGH severity. Affected product deployments should be reviewed for exposure and patched or mitigated accordingly.
CVE-2026-54400 is a CRITICAL Improper Access Control vulnerability in UniFi Access Application. A malicious actor with access to the network and high privileges could exploit this vulnerability to escalate privileges on the host device. The vulnerability has a CVSS score of 9.1. The vulnerability is caused by an Improper Access Control issue in UniFi Access Application, allowing an attacker with high priv [truncated]
CVE-2026-50747 is a series of authenticated SQL Injection vulnerabilities in UniFi Talk Application that could allow a malicious actor with access to the network and low privileges to escalate privileges on the host device. The vulnerability has a CVSS score of 9.9 and is classified as CRITICAL. The affected product is UniFi Talk Application, and the vulnerability class is SQL Injection. The likely operat [truncated]
CVE-2026-50746 involves an Improper Access Control vulnerability in the UniFi Connect Application. A malicious actor with network access could exploit this vulnerability to execute Command Injection on the host device. The vulnerability has a CVSS score of 10 and is classified as CRITICAL. Administrators and users of UniFi Connect Application should be aware of this vulnerability and take necessary action [truncated]
CVE-2026-34910 is a Critical vulnerability disclosed on 2026-05-22 affecting UniFi OS devices, where improper input validation could allow a network-accessible command injection. The NVD record rates the issue CVSS 10.0 with no privileges required and no user interaction, making it a high-priority exposure for any environment running the affected platform.
Published on 2026-05-22, CVE-2026-34909 is a critical path traversal vulnerability in UniFi OS devices. A network-accessible attacker could access files on the underlying system and, according to the CVE description, potentially manipulate that access to reach an underlying account. NVD rates the issue CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and maps it to CWE-22.
CVE-2026-34908 is a critical improper access control issue affecting UniFi OS devices. According to the CVE description and NVD metadata, a network-accessible attacker could abuse the flaw to make unauthorized changes to the system. The NVD record lists the issue as remotely exploitable with no privileges or user interaction required, and the impact is rated high across confidentiality, integrity, and availability.
CVE-2026-48610 is a HIGH-severity vulnerability (CVSS Score: 8.1) affecting certain devices running UniFi OS. An Improper Access Control vulnerability allows a malicious actor with network access to make unauthorized changes to UniFi OS devices under specific network configurations.
CVE-2026-47370 is a CRITICAL vulnerability with a CVSS score of 9.9. A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances. The vulnerability was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-47370) a [truncated]
CVE-2026-47369 is a critical vulnerability with a CVSS score of 9.9, affecting certain devices running UniFi OS. The vulnerability is caused by an Improper Input Validation issue, which allows a malicious actor with access to the network and low privileges to escalate privileges within UniFi OS devices or instances. The vulnerability was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2 [truncated]
A Path Traversal vulnerability was discovered in certain devices running UniFi OS. This vulnerability, tracked as CVE-2026-47368, allows a malicious actor with access to the network to obtain data from affected UniFi OS devices or instances. The vulnerability has a CVSS score of 8.6, indicating a high severity level.
CVE-2026-47367 is a CRITICAL vulnerability with a CVSS score of 9.9. A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device.
CVE-2026-34911 is a high-severity path traversal issue (CWE-22) affecting UniFi OS devices. The supplied record says a network-accessible attacker with low privileges could reach files on the underlying system and potentially expose sensitive information. The CVSS v3.1 vector indicates no user interaction, low attack complexity, and high confidentiality impact.
CVE-2026-33000 is a critical improper input validation issue affecting UniFi OS devices. According to the NVD record, a network-accessible attacker with high privileges could trigger command injection, with potential impacts to confidentiality, integrity, and availability. The published CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, which indicates severe consequences despite the high-privilege prerequisite.
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. The affected products include airMAX AC, airMAX M, airFiber AF60-XG, and airFiber AF60. This vulnerability has a high CVSS score of 8.8, indicating a high severity level. Administrators and users of the affected produc [truncated]
