UniFi Protect AI Key CVE-2026-110455

Exploitation targets the UniFi Protect AI Key device and requires the attacker to have access to the network the device is reachable on. The vendor explicitly conditions exploitability on unspecified preconditions ('under certain conditions'), which aligns with the CVSS AC:H rating - the attacker cannot succeed against every deployment and must satisfy environment-specific state that is not attacker-controlled. Per the CVSS vector PR:N/UI:N, no authentication or user interaction is required once network access and those conditions are met. The primary limiting factors are network reachability of the AI Key (not typically exposed to the internet in a default segmented UniFi deployment) and the unspecified AC:H preconditions; the exact configuration or feature state needed is not disclosed in the advisory and should be verified with Ubiquiti.

The input CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) describes a network-reachable, unauthenticated (PR:N) command injection yielding full confidentiality, integrity, and availability loss - a high-severity profile. However, AC:H is the critical tempering signal: the vendor description's phrase 'under certain conditions' confirms that exploitation is not reliable against arbitrary deployments and depends on conditions outside the attacker's control, which materially lowers real-world exploitability. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is referenced - so there are currently no corroborating signals of active or imminent exploitation. SSVC framing: exploitation status is 'none' observed, automatability is likely low given AC:H, but technical impact is total. Net judgment: a genuine high-impact flaw worth prioritized patching on exposed UniFi Protect AI Key devices, but the AC:H gate plus the absence of EPSS/KEV/POC signals points to it being a lower immediate-threat item than its 8.1 score alone suggests. Missing data to note explicitly: no EPSS probability was supplied, and 'access to the network' in the description is not fully reconciled with PR:N - verify with Ubiquiti whether any adjacency or trust-boundary precondition applies.

An attacker positioned on the same network as a UniFi Protect AI Key device sends specially crafted input to a vulnerable interface that fails to properly validate it (CWE-20), injecting operating-system commands that execute on the device. Because the CVSS vector is PR:N/UI:N, no authentication or user interaction is required, but AC:H means the attacker must satisfy specific preconditions ('under certain conditions') before the injection succeeds. No public exploit code is referenced, so an attacker would need to develop the exploit independently.