CVE-2026-54406: Path Traversal in UniFi Network Application Allows Host Compromise

Technical summary

CVE-2026-54406 is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability in UniFi Network Application. The flaw permits an authenticated actor with high privileges to traverse the application's file access controls and write arbitrary files to the host device. The attack vector is network-based with low complexity; no user interaction is required. The vulnerability has a broad scope impact, affecting confidentiality protections (rated None in the CVSS vector) but carrying High severity for integrity and availability, resulting in a CVSS v3.1 score of 8.7.

Business impact

Exploitation could allow a privileged internal threat actor to achieve persistent access, deploy backdoors, modify system configurations, or degrade service availability on the host running UniFi Network Application. Organizations using self-hosted deployments are exposed to lateral movement and post-compromise activity. The high privilege requirement acts as a gatekeeping control, but a compromised admin account or insider threat could trigger full host-level compromise.

Affected systems

Self-hosted instances of Ubiquiti UniFi Network Application are affected. Cloud-hosted or managed deployments may have different risk profiles depending on their architecture. Organizations should verify which versions of UniFi Network Application are running in their environments and whether they are self-hosted on-premises or managed infrastructure.

Exploitability

Exploitation requires high-level privileges (PR:H) and network access, making opportunistic external attacks unlikely. However, the low complexity and lack of user interaction (UI:N) mean that any account with administrative credentials is a potential attack vector. If administrative credentials are compromised through phishing, lateral movement, or insider activity, the barrier to exploitation is minimal. The vulnerability has not been added to CISA's KEV catalog as of the data publication date.

Remediation

Patch UniFi Network Application to a fixed version as directed by Ubiquiti's advisory. Restrict administrative access using principle of least privilege and multi-factor authentication. Monitor privileged account activity and implement network segmentation to limit lateral movement. Review file system permissions on the host device to minimize write scope if compromise is suspected.

Patch guidance

Consult Ubiquiti's official security advisory for the specific fixed version applicable to your deployment. Apply patches during a maintenance window to minimize service interruption. Verify patch application by checking the application version in the management UI and confirming file integrity checksums if available from the vendor. Test in a non-production environment first to ensure compatibility with your infrastructure.

Detection guidance

Monitor UniFi Network Application logs for unusual file write operations or path traversal attempts, particularly those referencing directories outside the application's intended working directory. Watch for privilege escalation indicators following administrative login. Implement file integrity monitoring (FIM) on the host system to detect unauthorized file modifications. Network-based detection should focus on anomalous behavior from high-privilege accounts accessing the application.

Why prioritize this

Although exploitation requires high privilege, the scope of impact (system-wide, not just the application) and the integrity and availability consequences elevate this to a high-priority patch. Organizations with strong access controls and MFA may deprioritize slightly, but self-hosted environments without these protections should treat this as urgent, especially if admin credentials are used frequently or shared.

Risk score, explained

The CVSS 8.7 HIGH score reflects the combination of network accessibility, low attack complexity, system-wide scope (S:C), and high-impact integrity/availability consequences. The requirement for high privilege (PR:H) prevents a perfect score but does not reduce the severity below HIGH because privileged accounts are often targets of compromise and insider threats.

Frequently asked questions