What is the CVSS score of CVE-2026-22558?

CVE-2026-22558 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Ubiquiti are affected by CVE-2026-22558?

UniFi Network Application contains a NoSQL injection vulnerability that allows authenticated users with low-privilege access to escalate privileges and view sensitive data from higher-privileged…

How to fix or mitigate CVE-2026-22558?

Within 24 hours: Audit and restrict administrative access to UniFi Network Application; enforce strong password policies and multi-factor authentication for all user accounts. Within 7 days: Review access logs for suspicious privilege escalation attempts or database queries from low-privilege accounts; segment UniFi administrative interfaces from untrusted networks. Within 30 days: Monitor vendor security advisories for patch availability and apply immediately upon release; consider implementing a Web Application Firewall with rules to block NoSQL injection payloads targeting UniFi.

Ubiquiti CVE-2026-22558

HIGH

Improper Neutralization of Special Elements in Data Query Logic (CWE-943)

2026-03-19 support@hackerone.com

Ubiquiti Nosql Injection Privilege Escalation

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 13:52 vuln.today

CVE Published

Mar 19, 2026 - 15:16 nvd

HIGH 7.7

DescriptionCVE.org

An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to the network to escalate privileges.

AnalysisAI

UniFi Network Application allows authenticated attackers to escalate privileges via NoSQL injection with high confidentiality impact. The vulnerability enables network-accessible attackers holding low-privilege credentials to exploit database queries and access sensitive information belonging to higher-privileged users or contexts. With an EPSS score of 0.03% (7th percentile) and no public exploit identified at time of analysis, real-world exploitation probability is currently assessed as low despite the 7.7 CVSS severity rating.

Technical ContextAI

This vulnerability stems from CWE-943 (Improper Neutralization of Special Elements in Data Query Logic), commonly affecting applications using NoSQL databases such as MongoDB, CouchDB, or similar document stores prevalent in network management platforms. UniFi Network Application, Ubiquiti's centralized management software for UniFi networking equipment, fails to properly sanitize or validate user-controlled input before incorporating it into NoSQL database queries. Authenticated users can inject malicious query operators or conditions that alter the intended logic, potentially bypassing authorization checks or extracting data from collections they should not access. The scope change (S:C) in the CVSS vector indicates the vulnerability affects resources beyond its security scope, suggesting cross-tenant or cross-privilege-boundary data disclosure is possible.

Affected ProductsAI

Ubiquiti UniFi Network Application versions are affected by this authenticated NoSQL injection vulnerability. The vendor security advisory is published at https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b, though specific vulnerable version ranges have not been independently confirmed from the available data. The vulnerability was reported through HackerOne (support@hackerone.com), suggesting responsible disclosure through Ubiquiti's bug bounty program. Organizations running UniFi Network Application for managing UniFi switches, access points, gateways, and security appliances should consult the vendor advisory for precise version identification.

RemediationAI

Consult the official Ubiquiti security advisory at https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b for patch availability and specific upgrade instructions for UniFi Network Application. Until patching is completed, implement compensating controls including restricting administrative interface access to trusted IP ranges via firewall rules, enforcing strong authentication policies with multi-factor authentication for all UniFi accounts, conducting regular privilege audits to ensure least-privilege principles, and monitoring database query logs for suspicious NoSQL injection patterns such as unusual operators or conditional logic. Network segmentation should isolate UniFi management traffic from general user networks to reduce the attack surface available to low-privileged authenticated users.