CVE-2026-55112: UniFi OS Privilege Escalation in Protect Application

Technical summary

CVE-2026-55112 is an improper access control vulnerability (CWE-284) affecting UniFi OS implementations with the UniFi Protect application stack. The vulnerability requires network accessibility and existing low-privilege credentials, but no user interaction. The attack vector operates at the network level with high complexity, suggesting exploitation requires specific environmental conditions or timing. Successful exploitation grants the attacker confidentiality, integrity, and availability impact on the host device, yielding a CVSS v3.1 score of 7.5 (HIGH severity).

Business impact

Organizations deploying Ubiquiti UniFi infrastructure for network management and video surveillance face potential loss of device security boundaries. A compromised low-privilege account—whether through insider threat, credential theft, or lateral movement—becomes a pathway to full system compromise. This breaks the security model of role-based access and could allow attackers to manipulate network policies, access recorded video feeds, or disrupt infrastructure services.

Affected systems

This vulnerability affects a broad range of Ubiquiti UniFi OS devices, including Dream Machine (all variants: Pro, Special Edition, Pro Max, Beast), Dream Routers (standard and 7-series), Dream Wall, CloudKey, and all Network Video Recorder models (standard, Pro, Instant, G2, G2 Pro variants) as well as Enterprise NVR and Cloud Gateway variants (Max, Industrial, Fiber). Both firmware images and hardware appliances are impacted. Verify your specific firmware version against Ubiquiti's security advisory for exact patched builds.

Exploitability

Exploitation requires two preconditions: the attacker must have network access to the affected device and must possess low-privilege credentials. The high complexity rating suggests the vulnerability is not trivial—it may require specific application state, configuration, or timing. The lack of current public exploitation evidence (not currently in CISA KEV) does not eliminate the risk; once patched versions are released and disclosed, exploitation complexity may decrease or be overcome with targeted research.

Remediation

Patch all affected UniFi OS devices to the latest firmware version released by Ubiquiti following the CVE publication date of July 2, 2026. Prioritize devices in security-sensitive roles such as those managing surveillance or network access control. As an interim control, restrict network access to these devices to trusted administrators and monitor for unusual privilege escalation attempts in application logs.

Patch guidance

Contact Ubiquiti Support or check the Ubiquiti Security Advisory portal for patched firmware versions applicable to your specific hardware model. Firmware updates should be applied during a maintenance window to avoid service interruption. Test patches in a non-production environment first if feasible. Verify via Ubiquiti's advisory that your device model and current firmware version are covered by the patch. Enable automatic firmware updates if your deployment model supports it.

Detection guidance

Monitor UniFi OS application logs for failed and successful privilege escalation attempts, particularly around authentication and authorization events. Watch for unusual process execution at elevated privilege levels initiated by low-privilege user accounts. Network-based detection should focus on anomalous API calls or management interface access patterns from low-privilege contexts. Ensure that detailed audit logging is enabled on all affected devices and centrally collected for correlation and alerting.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH severity rating and broad device coverage across critical infrastructure. The requirement for only network access and low privileges makes it relevant to insider threat and post-compromise scenarios. The impact scope—confidentiality, integrity, and availability—means full device compromise is possible. Although not yet actively exploited at scale, the confluence of network accessibility, low privilege requirements, and high impact justifies urgent patching.

Risk score, explained

The CVSS 7.5 score reflects a vulnerability with significant real-world risk: network-accessible, low privilege barrier to entry, and complete compromise of system integrity and confidentiality. The HIGH severity classification is appropriate because the vulnerability sits at the intersection of ease of precondition satisfaction (low-privilege account) and maximum impact (full device control). Organizations should not delay remediation pending active exploit evidence; the vulnerability's structural characteristics are sufficiently dangerous.

Frequently asked questions