UniFi Network Application CVE-2026-55114

Exploitation requires the attacker to already possess a valid low-privileged account on the UniFi Network Application and network access to its management interface (CVSS PR:L, AV:N, AC:L, UI:N) - it is NOT remote-unauthenticated. The limiting factors that reduce real-world risk: an existing authenticated foothold is mandatory, so deployments with no delegated/limited accounts (single super-admin home setups) present little exploitable surface; network reachability to the controller UI/API is required, so controllers isolated to management VLANs or VPN are harder to reach. There is no user-interaction requirement and complexity is low, so any attacker meeting the low-privilege prerequisite can exploit it reliably. The exact vulnerable feature or endpoint is not specified in the available data - consult Ubiquiti Security Advisory Bulletin 066 for the precise affected function.

The signals are moderately consistent and point to a genuine priority for anyone running a multi-tenant or multi-admin UniFi controller. CVSS 3.1 is 8.8 (High) with AV:N/AC:L/PR:L/UI:N and C:H/I:H/A:H - network reachable, low complexity, requires an existing low-privileged account, no user interaction, and full impact on the application. This is a classic broken-access-control privilege escalation: not remote-unauthenticated, but trivial for anyone who already has any foothold account. Mitigating the urgency, there is no public exploit code identified, it is not in CISA KEV, and no EPSS score was supplied in the input, so real-world exploitation probability cannot be quantified from the data provided. The 'Authentication Bypass' tag slightly overstates the mechanism - the CVSS vector clearly shows PR:L (a valid low-privileged account is needed), so this is authorization bypass / privilege escalation rather than a true pre-auth bypass; treat the tag with caution. Net: high-value where untrusted or limited-role accounts exist (managed service providers, shared controllers), lower urgency for single-super-admin home deployments where no low-privileged accounts exist to abuse.

An attacker who already holds a limited or read-only UniFi account - obtained via delegated access, a shared MSP tenant, or reused/leaked credentials - sends crafted requests to the controller's network-facing API that perform a privileged action their role should not permit. Because the authorization check is missing (CWE-284) and no user interaction is needed, they elevate to full administrative control over the UniFi Network Application, gaining ability to reconfigure networks and devices. No public proof-of-concept is currently identified, so this scenario reflects the CVSS vector rather than an observed exploit.