Ubiquiti UniFi OS CVE-2026-54401

Exploitation requires network access to the UniFi OS management interface plus a valid low-privileged account on the device (CVSS PR:L, so authenticated but not administrative); no user interaction is needed (UI:N). The limiting factors are therefore authentication and network reachability: an attacker must already possess or obtain low-privilege credentials, and the management interface/API must be reachable from the attacker's position. Impact is scoped to the affected UniFi OS device or instance (privilege escalation 'within such UniFi OS devices or instances', S:U - no scope change to other systems). Any UniFi OS build below 5.1.19 across the listed product lines is vulnerable; devices at 5.1.19 or later are not.

The signals are mixed and point to a genuine but non-emergency priority. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) reflects easy network exploitation by a low-privileged user with full impact once escalated. However, EPSS is only 0.20% (10th percentile) and CISA's SSVC evaluation records Exploitation: none, Automatable: no, and Technical Impact: partial - the 'partial' technical impact is somewhat softer than the CVSS 'C:H/I:H/A:H', suggesting the escalation may not yield total device takeover in every configuration. There is no KEV listing and no public exploit identified at time of analysis. Net: patch on a normal maintenance cadence, prioritizing internet-exposed or multi-tenant controllers where low-privileged accounts exist, but this is not a drop-everything zero-day. Note the tension between the high CVSS integrity/availability metrics and SSVC's 'partial' technical impact - verify the real blast radius against the vendor advisory before deprioritizing.

An attacker who holds a low-privileged UniFi OS account (or compromises one) on a reachable Dream Machine or UniFi OS Server submits a crafted request to a URL-fetching feature, causing the device to issue requests to its own internal management services. By steering those server-side requests to privileged loopback endpoints, the attacker escalates privileges within the appliance. No public exploit code is known at time of analysis, and the network vector with low attack complexity makes exploitation straightforward once a foothold account exists.