CVE-2026-55118: UniFi Network Application Privilege Escalation Vulnerability – HIGH Severity

Technical summary

This vulnerability stems from improper access control (CWE-284) in the UniFi Network Application. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) indicates network-based attack feasibility with low complexity, requiring low privileges but no user interaction. The confidentiality impact is low, but integrity and availability impacts are high, suggesting an authenticated attacker can alter configurations or disable services. The vulnerability does not escape the application context (scope:unchanged), keeping damage limited to UniFi governance itself rather than the underlying host or network infrastructure.

Business impact

Successful exploitation allows a low-privileged user—such as a junior admin, contractor, or compromised service account—to escalate into an administrative role within UniFi Network Application. This enables unauthorized modification of network policies, rogue device provisioning, guest network misconfiguration, or service disruption. For organizations relying on UniFi for network access control and security policy enforcement, this represents a significant insider threat and a potential stepping stone for lateral movement if the attacker intends to pivot beyond the application itself.

Affected systems

Ubiquiti UniFi Network Application instances are affected. The vulnerability applies to any deployment where the application is used to manage network infrastructure. Organizations using UniFi for branch offices, campuses, or SMB environments should prioritize inventory and patch status verification. The exact affected versions are not specified in the published vulnerability data; refer to Ubiquiti's advisory for version scope and whether cloud-hosted or self-hosted deployments carry differing risk.

Exploitability

Exploitation requires an attacker to already hold network access and low-level application credentials. The attack vector is network-based with low attack complexity, meaning no complex exploitation steps are needed once the attacker is authenticated. However, the prerequisite—obtaining initial credentials—adds a friction factor. This is realistic in scenarios involving insider threats, credential theft, compromised service accounts, or lateral movement from a network compromise. The CVSS score of 8.3 (HIGH) reflects the severity of the post-exploitation impact rather than ease of initial access.

Remediation

Patch the UniFi Network Application to a version that addresses CWE-284 access control flaws. Ubiquiti will release a patched version; verify the specific version numbers and timing from their official security advisory. Until patching is possible, implement compensating controls: restrict network access to the UniFi application management interface via firewall rules, enforce network segmentation so that only trusted administrators can reach the application, implement strong credential policies and multi-factor authentication for all application users, and monitor for suspicious privilege-escalation activity within application logs.

Patch guidance

Contact Ubiquiti directly or monitor their security portal for an updated UniFi Network Application version. Test the patch in a lab environment before production deployment to ensure compatibility with existing network configurations and controller settings. Patch management should prioritize this vulnerability given its HIGH severity and the potential for unauthorized administrative access. Schedule patching during a maintenance window, as application updates may require controller restart.

Detection guidance

Monitor UniFi Network Application logs for authentication events and permission changes, particularly unexpected elevation of user roles or creation of new administrative accounts. Track API calls and configuration modifications initiated by low-privileged users. Network detection should focus on unusual traffic patterns to the UniFi controller from internal hosts and authentication anomalies (e.g., login failures followed by success, or access from atypical locations). Organizations with SIEM integration should alert on privilege-escalation indicators and configuration drift that deviates from baselines.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH CVSS score (8.3), high integrity and availability impact, and the sensitive nature of network management systems. While initial access requires existing credentials, the post-exploitation impact—unauthorized administrative control of network infrastructure—is severe. Organizations should patch within days rather than weeks. The absence of KEV designation does not diminish urgency; it reflects current threat intelligence status, not relative risk.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) is driven by high integrity and availability impacts that follow successful privilege escalation. Although attack complexity is low and prerequisites include existing credentials, the confidentiality, integrity, and availability triad is heavily weighted toward compromise. Network-based attack vector and no required user interaction elevate exploitability. The score appropriately reflects the risk posed by an insider or post-breach attacker gaining unauthorized administrative privileges in a network control system.

Frequently asked questions