What is the CVSS score of CVE-2026-55110?

CVE-2026-55110 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of UniFi OS are affected by CVE-2026-55110?

Ubiquiti UniFi OS contains a session hijacking vulnerability enabling remote attackers to execute privileged administrative actions by exploiting a permissive CORS policy, provided they can socially…. A patch is available.

How to fix or mitigate CVE-2026-55110?

Within 24 hours: Issue security advisory to all UniFi OS administrators instructing them to disable remote admin access and restrict administrative console access to trusted internal networks only; document all current administrative users and sessions. Within 7 days: Implement network segmentation isolating UniFi OS management interfaces; require multi-factor authentication and VPN for any remote administrative access; enable and baseline audit logging of all configuration changes. Within 30 days: Contact Ubiquiti for patch status and timeline; evaluate air-gapping non-critical UniFi deployments; deploy DNS filtering and browser isolation on administrative workstations; establish formal patch acceptance testing procedures for when vendor patch becomes available.

UniFi OS CVE-2026-55110

EUVD-2026-41388 MEDIUM

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-07-02 hackerone

GHSA-fwmw-87x4-wjv5

Information Disclosure Cors Misconfiguration Ubiquiti Network Attached Storage Unifi Os Server Express 7 Dream Machines Enterprise Fortress Gateway Dream Wall Dream Routers Cloud Keys Network Video Recorders Enterprise Video Recorders Cloud Gateways Enterprise Firewall Core Ubiquiti Inc

6.1

CVSS 3.1 · NVD

Severity by source

Vendor (hackerone) PRIMARY

HIGH

qualitative

NVD

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

7.5 HIGH

Network-reachable but attacker-unauthenticated (PR:N) exploitation depends on a lured, already-logged-in admin (UI:R) and non-trivial CORS/timing conditions (AC:H), yielding full session-level C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 09, 2026 - 18:37 NVD

HIGH MEDIUM

CVSS changed

Jul 09, 2026 - 18:37 NVD

7.5 (HIGH) 6.1 (MEDIUM)

Patch available

Jul 02, 2026 - 16:17 EUVD

Analysis Generated

Jul 02, 2026 - 15:36 vuln.today

DescriptionNVD

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.

AnalysisAI

Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious web page ride that user's active session to perform privileged actions on the device, stemming from a permissive CORS policy that trusts untrusted origins. The flaw affects UniFi OS Server and the console firmware running on Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Cloud Keys, Enterprise Fortress Gateway, Express 7, and Network/Enterprise Video Recorders. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; success hinges on social-engineering an already-logged-in admin (CVSS 7.5, UI:R, AC:H).

Technical ContextAI

The root cause is CWE-942 (Permissive Cross-Origin Resource Sharing / cross-domain policy with untrusted domains). UniFi OS exposes a browser-facing management API, and its CORS response headers (Access-Control-Allow-Origin, and likely Access-Control-Allow-Credentials) are configured too loosely, reflecting or trusting arbitrary origins. Because credentialed cross-origin requests are permitted, JavaScript running on an attacker-controlled site can issue authenticated XHR/fetch calls to the UniFi OS console using the victim's session cookies and, critically, read the responses - turning what browser same-origin policy is meant to prevent into a scriptable cross-site data-exfiltration and action-triggering primitive. Per CPE data the affected code is the UniFi OS platform (cpe:2.3:a:ubiquiti_inc:unifi_os_server and the console firmware for dream_machines, dream_routers, dream_wall, cloud_gateways, cloud_keys, enterprise_fortress_gateway, express_7, network_video_recorders, enterprise_video_recorders).

RemediationAI

Apply the UniFi OS update referenced in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc) - patch available per vendor advisory, but the input does not specify an exact fixed version, so verify and install the patched build for your specific console (UniFi OS Server, Dream Machine/Router/Wall, Cloud Gateway/Key, Express 7, or NVR/EVR) from that bulletin; enable automatic firmware updates where supported. As compensating controls until patched, restrict the UniFi OS web management interface to trusted management networks or VPN (do not expose the console UI to the internet or untrusted VLANs), which limits reach but does not stop an insider-lured browser on the same network; administrators should log out of the console when not actively using it and avoid browsing untrusted sites in the same browser session as an active UniFi login, since the attack requires a live authenticated session (trade-off: operational inconvenience, and it relies on user discipline rather than a technical control). Browser-side mitigations such as using a dedicated browser profile for device administration reduce the chance that an attacker page shares the authenticated session.