Ubiquiti CVE-2026-22558
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to the network to escalate privileges.
AnalysisAI
UniFi Network Application allows authenticated attackers to escalate privileges via NoSQL injection with high confidentiality impact. The vulnerability enables network-accessible attackers holding low-privilege credentials to exploit database queries and access sensitive information belonging to higher-privileged users or contexts. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Audit and restrict administrative access to UniFi Network Application; enforce strong password policies and multi-factor authentication for all user accounts. Within 7 days: Review access logs for suspicious privilege escalation attempts or database queries from low-privilege accounts; segment UniFi administrative interfaces from untrusted networks. …
Sign in for detailed remediation steps.
More from same product – last 7 days
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Command injection in Ubiquiti UniFi OS devices allows a high-privileged attacker on the network to execute arbitrary ope
Path traversal in Ubiquiti UniFi OS devices allows authenticated low-privileged network attackers to read arbitrary file
Share
External POC / Exploit Code
Leaving vuln.today