CVE-2026-55113: UniFi Talk SSRF Vulnerability – HIGH Severity Authentication Bypass and DoS

Technical summary

CVE-2026-55113 is an SSRF vulnerability (CWE-918) in UniFi Talk Application that permits remote, unauthenticated request forgery. The attack vector is network-based with high complexity requirements. The vulnerability permits limited integrity impact and high availability impact across connected systems (scope changed). The CVSS 3.1 score of 7.5 reflects the combination of authentication bypass on API endpoints and denial-of-service capabilities, tempered by the elevated attack complexity needed to exploit the flaw.

Business impact

Successful exploitation could interrupt UniFi Talk services, preventing legitimate communication and collaboration. Authentication bypass on API endpoints creates secondary risk vectors for data access or service manipulation. Organizations relying on UniFi Talk for unified communications face potential operational disruption and may need to implement compensating controls while patches are tested and deployed.

Affected systems

The vulnerability affects Ubiquiti's UniFi Talk Application. All versions prior to the patched release are potentially vulnerable. Organizations running UniFi Talk in network environments should inventory their deployments and assess network segmentation posture, as exploitation requires network-level access.

Exploitability

Exploitation requires network connectivity to the vulnerable application but does not require authentication or user interaction. Attack complexity is rated as high, indicating that successful exploitation depends on specific environmental or configuration factors that are not trivial to satisfy. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning active, reliable exploits are not publicly confirmed at this time, though the attack surface remains significant.

Remediation

Apply the security patch released by Ubiquiti for UniFi Talk Application as soon as testing permits. Prioritize patching for systems that are internet-facing or accessible from untrusted network segments. Pending patch deployment, enforce network access controls to restrict traffic to UniFi Talk API endpoints only from authorized administrative networks.

Patch guidance

Consult Ubiquiti's official security advisory for the specific patched version number and deployment instructions. Test patches in a non-production environment first, particularly for critical communication infrastructure. If your organization has Ubiquiti support contracts, prioritize obtaining updated release notes and compatibility information before rolling out fixes to production systems.

Detection guidance

Monitor for unusual SSRF-like patterns in network traffic, including unexpected outbound requests from UniFi Talk servers to internal resources or external destinations. Watch for failed authentication attempts followed by successful API access on UniFi Talk endpoints. Log and alert on any unusual or failed requests to sensitive API paths. If available, enable verbose logging on UniFi Talk API endpoints to capture request source, method, and target details.

Why prioritize this

This vulnerability merits prompt remediation due to its HIGH CVSS score, the absence of authentication barriers for exploitation, and the cross-scope impact on availability. Although active exploitation is not yet documented in public threat feeds, the combination of API bypass and DoS capabilities creates meaningful risk, particularly for organizations with internet-exposed or insufficiently segmented UniFi Talk deployments. Network access requirement provides some friction but does not eliminate risk in shared or cloud-hosted environments.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible, unauthenticated attack path with high complexity factors, leading to availability impact and integrity bypass. The changed scope element indicates the vulnerability can affect connected systems beyond the vulnerable component itself. No confidentiality impact is documented, which moderates the score below critical levels. Organizations should weight this against their specific UniFi Talk role in business processes and network trust models.

Frequently asked questions