UniFi Access CVE-2026-55117

Exploitation requires network reachability to the UniFi Access Application's web/management service; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed against an affected instance. The limiting factor is network exposure rather than credentials: the attacker must be able to reach the application's listening interface, which in typical UniFi Access deployments is on a LAN/management network rather than the public internet, so segmentation is the primary practical barrier. No special product feature toggle or non-default configuration is called out in the description as a precondition; the traversal is reachable on affected versions as deployed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, score 8.6) describes an easily reached, unauthenticated, network-based read primitive with a scope change, which is why the score is high despite only confidentiality being impacted. Real-world risk is tempered by several factors: no EPSS score was provided, the vulnerability is not in CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The description says 'a malicious actor with access to the network,' which aligns with AV:N but in practice UniFi Access management interfaces are frequently LAN- or VLAN-segmented rather than internet-exposed, so the practical attack surface is often network-adjacent rather than fully internet-wide - verify exposure of the management port in your environment. Impact is limited to information disclosure (I:N/A:N), so this is a data-exposure and reconnaissance risk (config, credentials, tokens, keys readable from disk) rather than direct code execution, though disclosed secrets could enable follow-on compromise.

An attacker with reachability to the UniFi Access management interface sends a crafted HTTP request containing directory-traversal sequences (e.g., ../../) in a file or path parameter to read sensitive files from the host, such as configuration files, credential stores, or private keys. Because no authentication is required (PR:N) and complexity is low (AC:L), the request can be issued without prior access; no public POC is currently referenced, so an attacker would need to identify the vulnerable parameter themselves.