What is the CVSS score of CVE-2026-54405?

CVE-2026-54405 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of UniFi Network Application are affected by CVE-2026-54405?

Ubiquiti's UniFi Network Application is vulnerable to denial-of-service attacks that could render network management capabilities unavailable for affected organizations.. A patch is available.

How to fix or mitigate CVE-2026-54405?

24 hours: Inventory all UniFi Network Application instances in your environment and assess criticality to business operations; implement network-level access controls to restrict connectivity to the application from untrusted sources. 7 days: Enable security logging on all UniFi instances and configure monitoring for malformed input patterns; establish alternative network management procedures in case of outage. 30 days: Monitor Ubiquiti security advisories for patch release; establish testing and deployment procedures for when a fix becomes available.

UniFi Network Application CVE-2026-54405

EUVD-2026-41380 HIGH

Improper Input Validation (CWE-20)

2026-07-02 hackerone

GHSA-j2cq-vphm-g3w3

Ubiquiti Denial Of Service Unifi Network Application

7.5

CVSS 3.1 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity input-validation flaw with no user interaction; impact is availability-only (process crash), so C:N/I:N/A:H and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 02, 2026 - 16:17 EUVD

Analysis Generated

Jul 02, 2026 - 15:33 vuln.today

DescriptionCVE.org

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Denial of Service (DoS) attack on the application.

AnalysisAI

Denial of service in Ubiquiti's UniFi Network Application allows a remote, unauthenticated attacker with network access to crash or render the application unavailable by sending malformed input that the application fails to properly validate (CWE-20). The flaw carries a CVSS 7.5 rating driven entirely by availability impact (C:N/I:N/A:H), with no confidentiality or integrity consequences. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

UniFi Network Application is Ubiquiti's centralized controller software for managing UniFi network infrastructure (access points, switches, gateways). The affected component is identified by CPE cpe:2.3:a:ubiquiti_inc:unifi_network_application, and all versions prior to the patched release are implicated (the CPE version field is a wildcard). The root cause is CWE-20 (Improper Input Validation): the application accepts network-supplied data without adequately checking its structure, type, or bounds, allowing crafted input to drive the process into an unrecoverable or crashing state. Because the controller typically listens on the network for device and administrative traffic, the input-handling path is reachable remotely.

RemediationAI

Upgrade UniFi Network Application to the fixed release identified in Ubiquiti Security Advisory Bulletin 066-066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); the exact patched version number is not specified in the available data and should be taken directly from that advisory. As this is a network-reachable DoS, the most effective compensating control until patching is to restrict network exposure of the controller: place the UniFi Network Application management interfaces behind a firewall or VPN and limit inbound access to trusted management networks and known UniFi device subnets only, which reduces the attacker population at the cost of requiring VPN/segmentation for remote admin access. Because impact is limited to availability, monitoring the controller process for crashes and configuring automatic restart/watchdog behavior can shorten outage windows, though it does not prevent repeated triggering.