EUVD-2026-100838
GHSA-f7f5-358j-wfqf
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Signals align toward genuine priority for affected environments. The vendor-provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the CWE-284 Improper Access Control classification is consistent with the 'Authentication Bypass' tag. Impact is mixed: confidentiality and integrity are rated Low while availability is High (A:H), which drives the 8.6 base score - the dominant real-world risk is denial of service against the device, with secondary information disclosure and unauthorized changes. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or exploit automation at this time - this is a high-CVSS finding without (yet) corroborating exploitation signals. One caveat: the description states 'a malicious actor with access to the network,' which the CVSS vector encodes as AV:N/PR:N; this implies the attacker must have reachability to the device's network segment but needs no credentials, so realistic exposure depends heavily on whether the UniFi Protect AI Key is reachable from untrusted networks versus an isolated management VLAN. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Unauthenticated attackers who can reach the Ubiquiti UniFi Protect AI Key over the network can abuse an improper access control weakness to read information from the device, make unauthorized changes, and knock it offline. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, base 8.6) confirms the attack requires no credentials and no user interaction, with the dominant impact being a high-availability Denial of Service and limited confidentiality and integrity effects. No public exploit code was identified and there is no CISA KEV listing at time of analysis; Ubiquiti's Security Advisory Bulletin 070 is the authoritative source for affected firmware and fixes.
RemediationAI
Ubiquiti published Security Advisory Bulletin 070 (https://community.ui.com/releases/Security-Advisory-Bulletin-070-070/e7ffc9fa-9129-4a90-b5e3-d597c5ee7a73), and the supplied data does not include an exact fixed firmware version, so the first step is to read that bulletin and update the UniFi Protect AI Key to the release it identifies - patch status for a specific version is not confirmed from the available data. Until the device is updated, treat it as an unauthenticated, network-reachable risk and reduce exposure: place the AI Key on a dedicated management VLAN or isolated camera segment that no untrusted host (guest Wi-Fi, IoT, general user subnets) can route to, and use firewall rules to permit only the Protect controller/NVR addresses to the ports it needs. This segmentation directly blunts the high-availability DoS component, but the trade-off is that overly broad blocking breaks Protect pairing, remote viewing, and cloud connectivity, so rules should be built from observed traffic rather than a blanket deny. If remote or cloud access to the device is not required, disabling it removes an entire attack surface, at the cost of losing off-site access and mobile-app functionality. Monitor device and network logs for anomalous unauthenticated requests or unexpected reboots/disconnects to detect exploitation attempts, and stage the firmware update during a maintenance window since the device may restart.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The weakness is classified as CWE-284 (Improper Access Control), the root-cause class covering missing or incorrect authorization checks on network-exposed interfaces - for example endpoints or device functions that should require an authenticated, privileged context but instead accept requests from any reachable client. The affected component is the UniFi Protect AI Key, an accessory in Ubiquiti's UniFi Protect video-surveillance ecosystem that performs on-device AI analytics work, so it typically sits on the camera/management network and is reachable by other hosts in that segment. The CPE entry cpe:2.3:a:ubiquiti_inc:unifi_protect_ai_key:*:*:*:*:*:*:*:* uses a wildcard version, meaning the vendor advisory has not been mapped here to a specific firmware range and all tracked builds should be treated as potentially affected until the bulletin is checked. The CVSS vector's PR:N/UI:N combination indicates the flaw is exploitable without prior authentication and without tricking an operator into an action, while AC:L and AV:N indicate a straightforward network request is sufficient. The low confidentiality and integrity scores combined with the high availability score mean the practical value to an attacker is disruption and tampering rather than wholesale data exfiltration.
Know when Unifi Protect Ai Key gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Primary rating from Vendor (Ubiquiti) · only source for this CVE.
CVSS VectorVendor: Ubiquiti
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.
Executive ViewAI
Ubiquiti's UniFi Protect AI Key is affected by an improper access control vulnerability (CVE-2026-110459, CVSS 8.6) that unauthenticated attackers can exploit over the network to read limited information, make unauthorized changes, and cause a denial of service that takes the device offline. Organizations using this device for physical security video management face potential surveillance outages and minor data exposure, which could disrupt security operations and incident response. Leadership should prioritize network isolation and monitoring until Ubiquiti releases a patch.
Network segmentation, restrict management access to trusted IPs, disable unnecessary remote services, monitor logs for anomalies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Unifi Protect Ai Key
View allPrivilege escalation in Ubiquiti's UniFi Protect AI Key lets a network-adjacent attacker abuse an improper access contro
Command injection in Ubiquiti's UniFi Protect AI Key lets a network-reachable, unauthenticated attacker (CVSS PR:N/UI:N)
Improper access control in the Ubiquiti UniFi Protect AI Key allows network-adjacent unauthenticated attackers to read l
Improper access control in Ubiquiti UniFi Protect AI Key allows remote unauthenticated attackers with network reachabili
Path traversal in UniFi Protect AI Key allows unauthenticated, network-reachable attackers to obtain limited information
A path traversal write/truncate primitive in Ubiquiti's UniFi Protect AI Key lets unauthenticated attackers who already
Exploit-DB