Back Cybersecuritynews

Critical Ubiquiti UniFi Vulnerabilities Allow Attackers to Seize Full Control of Underlying Systems

Cybersecuritynews •Guru Baran • March 19, 2026

Ubiquiti has disclosed two critical-to-high severity vulnerabilities in its widely deployed UniFi Network Application, including a maximum-severity flaw that could allow unauthenticated attackers to seize full control of underlying systems. Organizations running affected versions are urged to patch immediately. CVE-2026-22557: Path Traversal Enables Full System Compromise The more severe of the two flaws, tracked as […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Ubiquiti UniFi Vulnerabilities Enable Account Takeover Ubiquiti has disclosed two critical vulnerabilities in its UniFi Network Application, including CVE-2026-22557, a path traversal flaw that allows unauthenticated attackers to potentially take over user accounts. This vulnerability affects versions 10.1.85 and earlier of the UniFi Network Application, which is widely used for managing networking hardware. The second vulnerability, CVE-2026-22558, is a NoSQL injection flaw that allows authenticated users to escalate their privileges. Ubiquiti has released patches in versions 10.1.89 and later to address these issues. Organizations are urged to update their systems immediately to mitigate the risks. The vulnerabilities could lead to significant security breaches, given the popularity of Ubiquiti's products among both state-backed and criminal actors. Ubiquiti has a history of being targeted, highlighting the ongoing risks associated with its devices. 7 sources 73

Extracted Entities

Critical Ubiquiti UniFi Vulnerabilities Allow Attackers to Seize Full Control of Underlying Systems

The full story

Extracted Entities

Companies (1)

CVEs (1)

Platforms (1)

Vulnerabilities (1)