UniFi OS CVE-2026-54404

Exploitation requires an authenticated account: the CVSS vector specifies PR:L, so the attacker must already possess valid low-privileged credentials on the UniFi OS device or instance and network reachability to its management/API interface (AV:N, AC:L, UI:N). The concrete prerequisite named in the description is a low-privilege authenticated session on a UniFi OS device or self-hosted UniFi OS Server; there is no indication of a required non-default feature toggle. Limiting factors that reduce real-world risk: the account requirement excludes fully unauthenticated attackers, and exposure depends on the management interface being reachable from the attacker's network position - deployments that isolate UniFi OS administration to a trusted management network and tightly control who receives limited operator accounts materially shrink the attack surface.

The signals are moderately concerning but not top-tier emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable exploitation, low complexity, no user interaction, and full CIA impact - but critically requires PR:L, meaning the attacker must already hold a low-privileged authenticated account, which sharply limits the population of viable attackers compared to a pre-auth flaw. Scope is Unchanged, so impact stays within the UniFi OS security authority. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified from these sources; there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a real priority for organizations that grant limited UniFi accounts to multiple operators or expose management to semi-trusted networks, but the authentication precondition makes it a privilege-boundary hardening issue rather than a wormable internet-facing crisis. The description's 'access to the network and low privileges' is consistent with the AV:N/PR:L vector, so no conflict is present.

An attacker who has been issued (or has phished/compromised) a limited UniFi operator account connects to the UniFi OS management interface over the network and submits crafted input to a vulnerable parameter, injecting SQL that manipulates authorization data. By chaining the series of injection points, they elevate their session to administrative privileges over the gateway or recorder. No public exploit is identified at time of analysis, and low CVSS attack complexity means a working exploit, once developed, would be reliable to run.