Unifi Network Application CVE-2026-22557

Network access to UniFi Network Application. Anonymous remote attacker can exploit path traversal to access system files and manipulate underlying accounts. No authentication or user interaction required. Affects default configurations.

The CVSS 10.0 score reflects maximum severity across all dimensions: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), scope change (S:C), and high impact to confidentiality, integrity, and availability. The combination of unauthenticated remote exploitation with the ability to access and manipulate system files leading to account compromise represents an exceptional risk. UniFi Network Applications are commonly deployed in enterprise and service provider environments for managing wireless networks, making them attractive targets with potentially broad attack surfaces exposed to networks. While EPSS scores and KEV status are not provided, the critical CVSS score, network-based attack vector, and lack of authentication requirements suggest this should be treated as a priority patching candidate. The scope change indicator means attackers can potentially impact resources beyond the vulnerable application itself.

An unauthenticated attacker on the network identifies an exposed UniFi Network Application interface and crafts malicious HTTP requests containing path traversal sequences to access sensitive system files such as configuration files, password databases, or SSH keys. By manipulating these accessed files (for example, modifying configuration files or extracting credential hashes), the attacker escalates privileges to gain administrative access to the underlying system or the UniFi controller itself. From this position, the attacker could reconfigure network infrastructure, intercept traffic, deploy persistent access mechanisms, or pivot to other systems managed by the controller.