Critical UniFi flaws put Ubiquiti users at risk of full system takeover, patch now

Ubiquiti has disclosed two serious security flaws in the UniFi Network Application, and one of them is severe enough to demand immediate action. The most dangerous issue, tracked as CVE-2026-22557, carries a CVSS 3.1 score of 10.0 and can let an unauthenticated attacker with network access reach sensitive files on the underlying system and potentially take over an account there.

The second bug, CVE-2026-22558, is a high-severity authenticated NoSQL injection flaw. It requires valid access first, but it can still let an attacker escalate privileges inside the UniFi environment, which makes it a serious follow-up risk if an account has already been compromised.

For admins, the answer is simple. If your deployment runs an affected UniFi Network Application build, you should update immediately. Ubiquiti says the fixes are available in UniFi Network Application 10.1.89 or later, Release Candidate 10.2.97 or later, and UniFi Express firmware 4.0.13 or later, which bundles UniFi Network Application 9.0.118 or later.

What happened

According to Ubiquiti’s security bulletin, the more severe flaw is a path traversal bug in the UniFi Network Application. The National Vulnerability Database entry says the issue could let “a malicious actor with access to the network” access files on the underlying system, and those files could then be used to reach an underlying account. The CVSS vector shows no authentication and no user interaction are required.

The second issue affects authenticated users. NVD describes CVE-2026-22558 as a NoSQL injection vulnerability that could allow a malicious actor with authenticated access to the network to escalate privileges. While it is not as severe as the first bug, it still creates a meaningful risk for exposed or poorly segmented management environments.

Affected versions and fixed versions

The release trail also lines up with Ubiquiti’s bulletin. Ubiquiti’s release pages show UniFi Network Application 10.1.89 and UniFi OS Express 4.0.13 published on March 17, 2026, and the Express release specifically notes that it bundles UniFi Network 9.0.118.

Why this matters

Many UniFi deployments sit deep inside business and prosumer networks, where the controller has visibility into access points, gateways, switches, users, and network policies. That does not automatically mean every environment is internet exposed, but it does mean a controller compromise can become a much larger operational problem than a typical app bug. This risk rises sharply if the management interface is reachable from untrusted networks.

The CVSS 10.0 rating on CVE-2026-22557 makes this especially urgent. NVD shows the CNA vector as AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which signals remote exploitation with low complexity and no need for authentication or user action. In practical terms, that is the type of flaw defenders usually patch first and investigate immediately afterward.

What admins should do now

• Update UniFi Network Application to 10.1.89 or later.
• Update Release Candidate deployments to 10.2.97 or later.
• Update UniFi Express to firmware 4.0.13 or later.
• Restrict access to the UniFi management interface to trusted networks only.
• Review firewall rules and VPN-only access policies for controller administration.
• Check logs and admin accounts for unusual activity after patching.

Those extra hardening steps matter because Ubiquiti’s bulletin frames the most severe issue around network access, not broad public internet scanning alone. If an attacker can reach the management surface, the risk increases fast.

Quick risk summary

FAQ