Back Sploitus

CVE-2026

Sploitus • October 14, 2026

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Found in UniFi Protect AI Key On October 14, 2026, a security advisory disclosed several vulnerabilities in the UniFi Protect AI Key, affecting versions 2.2.6 and earlier. The vulnerabilities include Improper Access Control (CVE-2026-110454, CVE-2026-110456, CVE-2026-110459), Improper Input Validation (CVE-2026-110455), and Path Traversal (CVE-2026-110457, CVE-2026-110458). These flaws allow a malicious actor with network access to execute command injections, access internal resources, and potentially launch Denial of Service attacks. The CVSS scores range from 3.7 to 8.6, indicating varying levels of severity. Users are advised to update to version 2.2.8 or later to mitigate these risks. The vulnerabilities can be chained, increasing their potential impact. 2 sources 46

Extracted Entities

CVE-2026

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)