CVE-2026-22564

nvd.nist.gov • April 14, 2026

This CVE record has recently been published to the CVE List and has been included within the NVD dataset.

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthorized changes to the system. Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier) UniFi Play Audio Port (Version 1.0.24 and earlier) Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later Update UniFi Play Audio Port to Version 1.1.9 or later

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in UniFi Play Devices On April 13, 2026, five critical vulnerabilities were published affecting UniFi Play devices, specifically the PowerAmp and Audio Port models. These vulnerabilities include CVE-2026-22562, a Path Traversal issue allowing remote code execution; CVE-2026-22563, a series of Improper Input Validation vulnerabilities enabling command injection; CVE-2026-22564 and CVE-2026-22566, both related to Improper Access Control that could permit unauthorized changes and credential exposure; and CVE-2026-22565, which could cause device unresponsiveness. All affected versions are 1.0.35 and earlier for PowerAmp and 1.0.24 and earlier for Audio Port. Users are urged to update to the latest firmware versions to mitigate these risks. The vulnerabilities pose significant risks to users with access to the UniFi Play network, potentially leading to unauthorized access and control over the devices. Current status indicates that patches are available, but the threat remains until updates are applied. 71

Extracted Entities

CVE-2026-22564

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)