CVE-2026-56842: UniFi Network Application Privilege Persistence Vulnerability (CVSS 7.5)

Technical summary

CVE-2026-56842 is an Incorrect Authorization vulnerability (CWE-863) in UniFi Network Application that permits privilege persistence. An authenticated attacker with low-level credentials can, under specific conditions, retain administrative or elevated privileges within the application after formal access revocation. The CVSS 3.1 score of 7.5 (HIGH) reflects network-based attack feasibility, low attack complexity, low privilege requirements, and high impact across confidentiality, integrity, and availability. The vulnerability requires an existing network connection and some conditional factor (AC:H) that increases attack difficulty slightly but remains exploitable by a determined adversary.

Business impact

Compromised access control in UniFi Network Application undermines network visibility and management authority. An attacker retaining admin-level access after removal can reconfigure network policies, monitor traffic, modify device settings, or persist for lateral movement into networked systems. For organizations using UniFi for WLAN, switching, or routing control, this creates a critical insider-threat scenario where revocation procedures fail silently, leaving sensitive infrastructure under attacker control without administrator awareness.

Affected systems

UniFi Network Application is affected. Ubiquiti's UniFi platform is widely deployed in enterprise, SMB, and education environments for unified network management. Any deployment running a vulnerable version of UniFi Network Application is at risk if network-accessible threat actors or malicious insiders hold or can obtain initial low-privilege credentials.

Exploitability

Exploitation requires existing network access and valid credentials at or above the low-privilege level. An attacker does not need high initial privileges, only a foothold. The attack is not currently listed in the CISA KEV catalog, indicating either limited observed exploitation or recent disclosure. However, the logic flaw underlying authorization bypass vulnerabilities is typically straightforward to chain into reconnaissance or lateral movement once the persistence mechanism is understood. Mitigation should not assume this will remain unexploited.

Remediation

Apply the official security patch from Ubiquiti as soon as it becomes available. Verify the patch version against Ubiquiti's security advisory to ensure correct remediation. In the interim, enforce strict network segmentation to limit which users and systems can access UniFi Network Application, and audit existing administrator accounts for anomalous or unexpected privilege retention. Monitor administrative logs for signs of privilege escalation or unauthorized access persistence.

Patch guidance

Consult Ubiquiti's official security advisory for UniFi Network Application for the specific patched version number and deployment instructions. Given the network-local attack vector and authorization logic involved, prioritize patching production UniFi controllers and ensure all instances are running the same hardened version. Test patches in a staging environment before production rollout to prevent management plane outages.

Detection guidance

Monitor UniFi Network Application administrative logs for: (1) accounts with privilege levels that do not match current role assignments; (2) access or configuration changes persisting after user removal; (3) logins from unexpected sources or timing patterns; (4) any audit trail gaps around privilege revocation events. Implement behavioral analytics to detect sessions that retain capabilities after expected termination. Network-level monitoring of traffic to UniFi controllers may reveal anomalous management API calls or configuration pushes from compromised accounts.

Why prioritize this

This vulnerability merits immediate attention in any organization running UniFi Network Application. The combination of persistent unauthorized access, administrator-level impact, and network-based attack surface creates substantial risk. Although not yet in CISA's KEV catalog, the authorization bypass pattern is a proven attack vector in mature threat modeling. Delayed patching leaves infrastructure under persistent attacker control without obvious detection.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: (1) Network attack vector—no physical access needed; (2) Low privilege requirement—attacker needs only basic credentials; (3) High attack complexity—successful exploitation depends on specific conditions being present, reducing but not eliminating likelihood; (4) High impact across confidentiality, integrity, and availability—attacker can view, modify, and disrupt network operations. The score does not include exploit availability premium, as the vulnerability is not yet publicly weaponized or widely exploited.

Frequently asked questions