CVE-2026-54403: UniFi OS Authentication Bypass via Path Traversal (CVSS 8.6)

Technical summary

CVE-2026-54403 is a path traversal vulnerability (CWE-22) in UniFi OS that permits authentication bypass via improper handling of file path inputs. The vulnerability has a CVSS 3.1 score of 8.6 (HIGH) with a network-based attack vector, low attack complexity, no privilege requirement, and no user interaction needed. The scope is changed, confidentiality impact is high, and integrity and availability impacts are none. This combination indicates the vulnerability enables unauthorized information disclosure across trust boundaries without requiring authentication or local access.

Business impact

Compromise of UniFi OS devices could disrupt network management capabilities and enable lateral movement within an organization's infrastructure. Attackers gaining administrative access to a UniFi controller or Dream Machine could view network topology, user activity, and configuration details; modify network policies; or potentially access connected systems. For organizations operating network video recorders, compromise could expose recorded footage and system metadata. The high confidentiality impact combined with the ease of exploitation (network access only, no credentials needed) makes this a material risk to network security posture.

Affected systems

This vulnerability affects a broad range of Ubiquiti products running UniFi OS, including the UniFi OS Server, UniFi Dream Machine family (standard, Pro, Pro Max, Beast, Special Edition), Enterprise Fortress Gateway, UniFi Dream Router and Router 7, UniFi Express 7, UniFi Cloud Key variants (standard, Plus, Enterprise), and UniFi Network Video Recorder models (standard, Pro, Instant, G2, G2 Pro). Both firmware and hardware versions are affected where UniFi OS is deployed. Organizations should verify their specific device models and firmware versions against vendor advisories.

Exploitability

This vulnerability is readily exploitable by any attacker with network access to an affected UniFi OS device. No authentication is required, no user interaction is necessary, and the attack has low complexity. This makes it a dangerous flaw in practice because internal network access—whether via compromised employee systems, guest networks, or physical access—provides a straightforward path to exploitation. However, the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog, meaning active exploitation in the wild has not been confirmed at time of publication.

Remediation

Organizations must apply security patches from Ubiquiti as soon as they become available. Patches should be deployed to all affected UniFi OS deployments, including Dream Machines, Cloud Keys, Network Video Recorders, and Dream Routers. Verify the specific patch version for your device model against the vendor advisory. Until patching is complete, implement network segmentation to restrict access to UniFi management interfaces—limit UniFi device access to trusted administrative networks and use a VPN for remote management rather than exposing devices directly to less-trusted networks.

Patch guidance

Check Ubiquiti's official security advisories for the specific patch version applicable to your device model and current firmware version. Patches typically address the path traversal flaw with input validation improvements. Deploy patches first to non-production UniFi instances if possible to validate compatibility with your network configuration. Prioritize Dream Machines and Cloud Keys used for centralized management, as compromise of these systems has the widest impact. Verify successful patching by confirming the new firmware version in the device's system information.

Detection guidance

Monitor UniFi OS logs and network traffic for unusual access patterns to management interfaces, including authentication bypass attempts or requests to non-standard paths. Look for HTTP/HTTPS requests containing traversal sequences (../, ..\, or encoded variants) targeting UniFi management endpoints. Implement network IDS/IPS signatures to detect path traversal attacks targeting UniFi OS. Additionally, audit access logs on affected devices for unauthorized session creation or administrative actions performed without matching user login records, which would indicate successful authentication bypass.

Why prioritize this

This vulnerability warrants high priority for patching due to its high CVSS score (8.6), the ease of exploitation (no credentials or user interaction required), and the broad attack surface (network access only needed). The widespread deployment of UniFi devices in enterprise and SMB networks amplifies risk. Although not currently in KEV, the combination of easy exploitation and high confidentiality impact makes this a logical target for opportunistic attackers. Organizations should treat this as a critical patch cycle item, especially for internet-connected or multi-tenant UniFi deployments.

Risk score, explained

The CVSS 3.1 score of 8.6 reflects a HIGH severity due to network-based attack vector, no privilege or user interaction requirement, changed scope, and high confidentiality impact. The attack complexity is low, meaning no special conditions are needed to exploit the flaw. Although integrity and availability are not impacted, the high confidentiality rating combined with the ease of exploitation justifies the elevated score. In a real-world context, this score translates to a flaw that poses material risk to any organization with UniFi OS devices exposed to untrusted networks.

Frequently asked questions