Back Securityaffairs.Co

Critical Ubiquiti UniFi UniFi security flaw allows potential account hijacking

Securityaffairs.Co •Pierluigi Paganini • March 19, 2026

Ubiquiti fixed two UniFi vulnerabilities, including a critical flaw that could let attackers take over user accounts. Ubiquiti patched two vulnerabilities in its UniFi Network app, including a maximum-severity flaw that could enable account takeover. The software is widely used to manage UniFi networking devices like access points, switches, and gateways. The Ubiquiti UniFi Network […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Ubiquiti UniFi Vulnerabilities Enable Account Takeover Ubiquiti has disclosed two critical vulnerabilities in its UniFi Network Application, including CVE-2026-22557, a path traversal flaw that allows unauthenticated attackers to potentially take over user accounts. This vulnerability affects versions 10.1.85 and earlier of the UniFi Network Application, which is widely used for managing networking hardware. The second vulnerability, CVE-2026-22558, is a NoSQL injection flaw that allows authenticated users to escalate their privileges. Ubiquiti has released patches in versions 10.1.89 and later to address these issues. Organizations are urged to update their systems immediately to mitigate the risks. The vulnerabilities could lead to significant security breaches, given the popularity of Ubiquiti's products among both state-backed and criminal actors. Ubiquiti has a history of being targeted, highlighting the ongoing risks associated with its devices. 7 sources 73

Extracted Entities

Critical Ubiquiti UniFi UniFi security flaw allows potential account hijacking

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Platforms (1)