Ui
Vulnerability activity for Ui: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 33
- Critical (CVSS 9+)
- 8
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.5HighJul 2, 2026Ui unifi network application Auth bypass / access controlCVE-2026-56842A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UniFi Network Application to persist privileges within UniFi Network Application after such access had been removed.
- 8.8HighJul 2, 2026Ui unifi protect SQL injectionCVE-2026-56841A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application to escalate privileges on the host device.
- 8.1HighJul 2, 2026Ui unifi talk application Auth bypass / access controlCVE-2026-55119A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk Application to escalate privileges within the UniFi Talk Application.
- 8.3HighJul 2, 2026Ui unifi network application Auth bypass / access controlCVE-2026-55118A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.
- 8.6HighJul 2, 2026Ui unifi access Path traversal / file handlingCVE-2026-55117A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Application to access files on the host device.
- 9.0CriticalJul 2, 2026Ui unifi connect Auth bypass / access controlCVE-2026-55116A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.
- 9.9CriticalJul 2, 2026Ui unifi protect SSRFCVE-2026-55115A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device.
- 8.8HighJul 2, 2026Ui unifi network application Auth bypass / access controlCVE-2026-55114A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.
- 7.5HighJul 2, 2026Ui unifi talk application SSRFCVE-2026-55113A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Application to execute a Denial of Service (DoS) attack and bypass authentication in certain UniFi Talk API endpoints.
- 7.5HighJul 2, 2026Ui unifi dream machine pro firmware Auth bypass / access controlCVE-2026-55112A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device.
- 7.5HighJul 2, 2026Ui protect floodlight firmware Path traversal / file handlingCVE-2026-55111A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to access files on the UniFi Protect Floodlight.
- 7.5HighJul 2, 2026Ui unifi os serverCVE-2026-55110A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.
- 7.5HighJul 2, 2026Ui unifi protectCVE-2026-54409A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authentication in UniFi Protect Cameras.
- 8.6HighJul 2, 2026Ui unifi protect Auth bypass / access controlCVE-2026-54408A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication for data streaming.
- 8.6HighJul 2, 2026Ui unifi protect Auth bypass / access controlCVE-2026-54407A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication in certain UniFi Protect Application API endpoints.
- 8.7HighJul 2, 2026Ui unifi network application Path traversal / file handlingCVE-2026-54406A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in self-hosted instances of UniFi Network Application to escalate write permission on the host device.
- 7.5HighJul 2, 2026Ui unifi network application Denial of serviceCVE-2026-54405A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Denial of Service (DoS) attack on the application.
- 8.8HighJul 2, 2026Ui unifi dream machine beast firmware SQL injectionCVE-2026-54404A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.
- 8.6HighJul 2, 2026Ui unifi os server Path traversal / file handlingCVE-2026-54403A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.
- 9.9CriticalJul 2, 2026Ui unifi os server Code / command injectionCVE-2026-54402A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.
- 7.7HighJul 2, 2026Ui unifi os server SSRFCVE-2026-54401A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
- 9.1CriticalJul 2, 2026Ui unifi access Auth bypass / access controlCVE-2026-54400A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.
- 9.9CriticalJul 2, 2026Ui unifi access Code / command injectionCVE-2026-50748A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
- 9.9CriticalJul 2, 2026Ui unifi talk application SQL injectionCVE-2026-50747A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device.
- 10.0CriticalJul 2, 2026Ui unifi connect application Auth bypass / access controlCVE-2026-50746A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Injection on the host device.
- 7.7HighMay 22, 2026Ui unifi os server Path traversal / file handlingCVE-2026-34911A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.
- 9.1CriticalMay 22, 2026Ui unifi os server Code / command injectionCVE-2026-33000A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
- 8.8HighJan 8, 2026Ui airmax ac firmware Memory corruptionCVE-2026-21639A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.
- 8.8HighJan 8, 2026Ui ubb-xg firmware Code / command injectionCVE-2026-21638A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: UBB-XG (Version 1.2.2 and earlier) UDB-Pro/UDB-Pro-Sector (Version 1.4.1 and earlier) UBB (Version 3.1.5 and earlier) Mitigation: Update your UBB-XG to Version 1.2.3 or later. Update your UDB-Pro/UDB-Pro-Sector to Version 1.4.2 or later. Update your UBB to Version 3.1.7
- 5.3MediumJan 5, 2026Ui unifi connect ev station lite firmware Auth bypass / access controlCVE-2026-21635An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device that was only adopted via Ethernet.
- 6.5MediumJan 5, 2026Ui unifi protect Memory corruptionCVE-2026-21634A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery protocol causing it to restart. Affected Products: UniFi Protect Application (Version 6.1.79 and earlier). Mitigation: Update your UniFi Protect Application to Version 6.2.72 or later.
- 8.8HighJan 5, 2026Ui unifi protect Auth bypass / access controlCVE-2026-21633A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application (Version 6.1.79 and earlier). Affected Products: UniFi Protect Application (Version 6.1.79 and earlier). Mitigation: Update your UniFi Protect Application to Version 6.2.72 or later.
- 7.5HighJan 5, 2026Ui argentina afip invoices XSSCVE-2025-59467A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. This plugin is disabled by default. Affected Products: UCRM Argentina AFIP invoices Plugin (Version 1.2.0 and earlier) Mitigation: Update UCRM Argentina AFIP invoices Plugin to Version 1.3.0 or later.
Top products
- unifi protect7 CVEs in the last year, 1 critical
- unifi os server6 CVEs in the last year, 2 critical
- unifi network application5 CVEs in the last year
- unifi talk application3 CVEs in the last year, 1 critical
- unifi access3 CVEs in the last year, 2 critical
- unifi dream machine pro firmware1 CVE in the last year
- unifi dream machine beast firmware1 CVE in the last year
- unifi connect ev station lite firmware1 CVE in the last year
- unifi connect application1 CVE in the last year, 1 critical
- unifi connect1 CVE in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.