Ubiquiti CVE-2026-22558

Attacker requires authenticated access to UniFi Network Application with any user account. No victim interaction needed. Exploits NoSQL injection in authenticated endpoints to escalate privileges from standard user to administrator.

The CVSS 3.1 score of 7.7 reflects network-accessible attack vector (AV:N), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and changed scope (S:C) with high confidentiality impact but no integrity or availability impact. However, the EPSS probability of 0.03% (7th percentile) indicates extremely low likelihood of exploitation in the wild based on current threat intelligence. No public exploit code exists and the vulnerability is not listed in CISA KEV, suggesting attackers have not yet weaponized this technique against UniFi deployments. The requirement for authenticated access and the confidentiality-only impact (no code execution or system compromise) reduce immediate operational risk. This represents a medium-priority issue requiring timely patching during normal maintenance windows rather than emergency response, particularly for deployments with strong credential management and network segmentation already limiting insider threat potential.

An attacker with legitimate low-privilege credentials to the UniFi Network Application (such as a read-only operator account) crafts malicious NoSQL query operators in API requests or web interface parameters. By injecting MongoDB operators like $ne, $gt, or $where into user-controlled fields, the attacker bypasses authorization logic and retrieves configuration data, credentials, or network topology information belonging to administrator accounts or other isolated network segments managed by the same controller. The low attack complexity enables exploitation without specialized tools once the injection point is identified.