Table of Contents
Is your Ubiquiti UniFi network application vulnerable to the recent CVE-2026-22557 attack?
Critical System Vulnerabilities
Recent public disclosures identify two severe security flaws in the Ubiquiti UniFi Network Application. These vulnerabilities require immediate attention to protect your IT infrastructure from unauthorized access. System administrators must patch their environments promptly to maintain secure network operations.
Understanding the Security Flaws
The first vulnerability is CVE-2026-22557. This remote path traversal issue carries a maximum CVSS 3.1 score of 10.0. Attackers can exploit this flaw without authentication to access and manipulate system files. Successful exploitation leads directly to a complete account takeover.
The second vulnerability is CVE-2026-22558. This authenticated NoSQL injection flaw has a CVSS 3.1 score of 7.7. An attacker with existing network access can use this vulnerability to escalate their system privileges.
The Ubiquiti UniFi Ecosystem
Ubiquiti provides comprehensive data communication hardware for homes and businesses. The UniFi Network, often called the UniFi Controller, manages high-performance internet gateways, scalable Wi-Fi, and network switches. The platform includes real-time traffic dashboards and visual topology maps to help administrators optimize network routing. Cloud gateways form the core of this system to grant full control over the IT infrastructure.
The broader UniFi Application Suite integrates several specialized platforms into one centralized ecosystem. UniFi Access manages physical door entry controls for facilities. UniFi Protect handles AI-powered local video surveillance with custom recording schedules. Additional services include UniFi Talk for VoIP communications and UniFi Connect for enterprise device management.
Affected Application Versions
Administrators must check their current software iterations to determine network risk levels. The vulnerabilities impact the following UniFi Network Application releases:
- Official Release versions 10.1.85 and earlier are affected.
- Release Candidate versions 10.2.93 and earlier contain the vulnerabilities.
- UniFi Express versions 9.0.114 and earlier remain vulnerable.
Required Security Updates
Ubiquiti has released official patches to secure your network devices. Apply the following updates immediately to resolve both vulnerabilities:
- Upgrade the Official Release to version 10.1.89 or newer.
- Upgrade the Release Candidate to version 10.2.97 or newer.
- Update the UniFi Express Firmware starting from version 4.0.13 to patch the application to version 9.0.118.