CVE-2026-54401: UniFi OS Privilege Escalation via SSRF—Patch Guidance

Technical summary

CVE-2026-54401 is a Server-Side Request Forgery (CWE-918) vulnerability in UniFi OS and related Ubiquiti devices. An authenticated, network-accessible attacker with low privileges can craft requests that the vulnerable system processes on its behalf, reaching internal services or APIs that enforce access controls based on the local system's identity rather than the originating user. By chaining this SSRF with other system functionality, an attacker escalates from low privilege to administrative capability. The flaw scores 7.7 (CVSS 3.1 HIGH) with a network attack vector, low complexity, and no user interaction required.

Business impact

Organizations deploying UniFi OS infrastructure face a significant internal threat if any user account is compromised or if attackers gain initial network foothold via phishing or supply-chain compromise. The vulnerability enables lateral movement and domain-wide takeover of network management systems that control firewalls, access points, switches, and video surveillance. Since many UniFi deployments are mission-critical for network operations and security enforcement, successful exploitation could result in complete loss of visibility and control over IT infrastructure, regulatory compliance violations, and extended remediation costs.

Affected systems

The vulnerability affects the entire UniFi OS ecosystem: UniFi OS Server, all UniFi Dream Machine variants (standard, Pro, Special Edition, Pro Max, Beast), Enterprise Fortress Gateway, UniFi Dream Router and Dream Router 7, Dream Wall, UniFi Express 7, all CloudKey models (standard, Plus, Enterprise), and all UniFi Network Video Recorder models (standard, Pro, Instant, G2, G2 Pro, and Enterprise variants). Both firmware and hardware SKUs are affected—verify your specific model and firmware version against Ubiquiti's advisory.

Exploitability

Exploitation is moderately accessible: it requires network access (not necessarily direct internet exposure) and valid low-privilege credentials, but does not require user interaction or social engineering. The low complexity score indicates the attack does not depend on rare conditions or race conditions. However, this is not a wormable vulnerability and does not spread automatically. The risk is highest in environments where (1) multiple users have UniFi OS access, (2) network perimeter controls are weak, or (3) UniFi devices are internet-facing without additional authentication layers.

Remediation

Ubiquiti must issue firmware patches that validate and restrict SSRF attack vectors within UniFi OS—specifically validating that outbound requests initiated by low-privilege users cannot reach administrative APIs or internal services. Mitigation strategies pending patches include: isolating UniFi management systems on restricted network segments, disabling unnecessary network connectivity on UniFi devices, enforcing multi-factor authentication for all accounts with management access, and monitoring for suspicious outbound requests from UniFi instances. Review your deployment architecture and consider whether UniFi OS access can be further restricted to trusted administrative staff only.

Patch guidance

Check Ubiquiti's security advisory for firmware versions that address this vulnerability across each affected product line—UniFi Dream Machine, CloudKey, Dream Router, and video recorder models each have separate firmware release schedules. Create a patching plan that prioritizes internet-facing or production-critical UniFi instances first. Test patches in a non-production environment before rolling out, as UniFi firmware updates can temporarily affect network management. Verify that all hardware variants (e.g., Pro Max, Beast, Enterprise editions) and associated firmware are included in your patch inventory. Document baseline configurations before patching to enable rollback if needed.

Detection guidance

Monitor UniFi OS logs and network traffic for signs of exploitation: (1) unusual outbound HTTP/HTTPS requests originating from UniFi management services to internal IP ranges, metadata servers, or localhost:port combinations that should not be accessed via the network; (2) failed or successful authentication attempts followed by privilege escalation activity in audit logs; (3) low-privilege user sessions accessing administrative APIs or endpoints; (4) changes to system configuration or administrative user accounts. If your SIEM can ingest UniFi OS event logs, alert on unexpected administrative actions performed by non-administrative accounts.

Why prioritize this

This vulnerability combines HIGH CVSS severity with broad product scope across UniFi's entire management and infrastructure line. The requirement for existing network access or credentials reduces immediate external threat likelihood, but organizations with hybrid work or multiple contractor accounts should elevate priority. The ability to escalate to full administrative control means this is a critical lateral movement and persistence risk. Prioritize patching if you operate internet-facing UniFi instances, manage sensitive networks, or operate in regulated industries (healthcare, finance, critical infrastructure).

Risk score, explained

The CVSS 3.1 score of 7.7 reflects: network-accessible attack vector (broad scope), low attack complexity (straightforward exploitation once the flaw is understood), requirement for low privileges (not unauthenticated), no user interaction, scope change from 'unchanged' to 'changed' (ability to affect other systems or services), high confidentiality impact (access to sensitive configuration or data), no integrity impact stated, and no availability impact stated. In practical terms, the 'changed scope' rating accounts for the privilege escalation and lateral movement potential. In environments with weak network segmentation or multiple UniFi user accounts, the practical risk may exceed the base score.

Frequently asked questions