Unifi Network Server CVE-2026-22559

The victim must be logged into UniFi Network Server (version 10.1.85 or earlier) and click a malicious link crafted by the attacker. Requires no special product configuration or authentication by attacker.

The CVSS 3.1 score of 8.8 reflects high severity with network-based attack vector, low attack complexity, no privileges required, but requiring user interaction. The attack can compromise confidentiality, integrity, and availability at high levels without scope change, indicating complete account takeover potential. The vulnerability was responsibly disclosed through HackerOne and tagged as an authentication bypass, suggesting it was identified through bug bounty rather than active exploitation. While the requirement for user interaction (clicking a malicious link) reduces immediate automated exploitation risk, the social engineering component makes this a realistic threat in targeted phishing campaigns against network administrators who have privileged access to infrastructure management. The network attack vector and authentication bypass capability make this a genuine priority for organizations using UniFi Network Server, particularly since administrators are high-value targets. The availability of a patch (version 10.1.89) and the low attack complexity mean exploitation is feasible once attack details become public, making prompt remediation critical despite no current evidence of widespread exploitation or public proof-of-concept code.

An attacker crafts a phishing email impersonating Ubiquiti support or a network status alert, containing a malicious link that exploits the improper input validation flaw. When a network administrator clicks the link while authenticated or in a context where their session can be hijacked, the malicious payload bypasses authentication controls and grants the attacker unauthorized access to the victim's UniFi Network Server account. With administrative access compromised, the attacker can reconfigure network infrastructure, deploy rogue access points, intercept traffic, or pivot to connected devices across the entire UniFi-managed network.