0333 032 8979 info@norsoc.com

UniFi Network Application (March 2026)

DATE ISSUED:
18/03/2026

SUBJECT:
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.

OVERVIEW:

Tracked as CVE-2026-22557, the security flaw impacts UniFi Network application version 10.1.85 and earlier and is addressed in versions 10.1.89 or later.

Successful exploitation enables threat actors without privileges to exploit a path traversal vulnerability to access files on the targeted devices and potentially hijack user accounts in low-complexity attacks that don’t require user interaction.

THREAT INTELLIGENCE:
No exploited systems found as yet.

SYSTEMS AFFECTED:

  • Official Release: UniFi Network application (Version 10.1.85 and earlier)
  • Release Candidate: UniFi Network application (Version 10.2.93 and earlier)
  • UniFi Express (UX): UniFi Network application (Version 9.0.114 and earlier)

TECHNICAL SUMMARY:

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.

Impact:

CVSS v3.1 Severity and Metrics:

Base Score: 10.0 (Critical)

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-22557 (n00r3(@izn0u))

RECOMMENDATIONS:

  • Official Release: Update UniFi Network application to Version 10.1.89 or later.

    Release Candidate: Update UniFi Network application to Version 10.2.97 or later.

    UniFi Express (UX): Update UniFi Express firmware to 4.0.13 or later, which updates the UniFi Network application to Version 9.0.118 or later.

REFERENCES:

 

Book A Chat

If you want to discuss your cyber security more or ask us any questions please do book a free no obligation chat with us.

Book Now