UniFi Network Application CVE-2026-55118

The attacker must already possess a valid low-privilege authenticated account on the UniFi Network Application (CVSS PR:L) and network reachability to its management interface (AV:N); no user interaction is needed (UI:N). The description explicitly qualifies exploitation with 'under certain conditions,' indicating additional non-default state or configuration prerequisites within the application that Ubiquiti has not fully detailed in the public data - these unspecified conditions, together with the requirement for pre-existing credentials, are the primary factors limiting real-world exploitation. Exploitation is therefore not available to a fully unauthenticated outsider despite the network vector.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, score 8.3 High) indicates network-reachable exploitation by an already-authenticated low-privilege user with no user interaction, yielding high integrity and availability impact but only low confidentiality impact - consistent with an authorization escalation rather than data exfiltration. A notable tension exists between the CVSS AC:L (low complexity) and the description's phrase 'under certain conditions,' which implies configuration- or state-dependent preconditions that would more naturally map to AC:H; this should be verified against the vendor advisory. No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation likelihood cannot be quantified from the input; the absence of KEV and POC suggests this is not currently mass-exploited. The practical gating factor is that an attacker must first hold valid low-privilege credentials to the controller, which meaningfully limits opportunistic exploitation but is realistic in multi-tenant or delegated-admin deployments (MSPs, managed sites).

An attacker who has been granted (or has compromised) a limited, low-privilege UniFi Network Application account authenticates to the controller over the network and invokes functionality that should be gated to full administrators, escalating to elevated control of the managed network. Because no user interaction is required and attack complexity is rated low, the action can be performed directly through the management interface once the required conditions are met. No public proof-of-concept was identified at time of analysis.