What is the CVSS score of CVE-2026-56841?

CVE-2026-56841 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of UniFi Protect are affected by CVE-2026-56841?

Ubiquiti UniFi Protect Application contains an authenticated privilege escalation vulnerability (CVE-2026-56841, CVSS 8.8) that allows low-privileged users with network access to gain complete…. A patch is available.

How to fix or mitigate CVE-2026-56841?

Within 24 hours: Conduct asset discovery to identify all UniFi Protect instances and assess network exposure; implement network segmentation to restrict administrative access to trusted management networks. Within 7 days: Deploy IP whitelisting for administrative interfaces, disable unnecessary remote access features, enable comprehensive audit logging, and implement network access controls (firewall rules). Within 30 days: Monitor Ubiquiti security advisories for patch availability; establish and execute patch testing plan upon patch release; evaluate Web Application Firewall (WAF) deployment for SQL injection detection if remote access cannot be fully disabled.

UniFi Protect CVE-2026-56841

EUVD-2026-41399 HIGH

SQL Injection (CWE-89)

2026-07-02 hackerone

GHSA-472v-99p9-6699

Ubiquiti SQLi Unifi Protect Application

8.8

CVSS 3.1 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable SQLi needs a low-privilege account (PR:L) and no user interaction (AC:L/UI:N); host privilege escalation yields high C/I/A on the same appliance (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 02, 2026 - 16:17 EUVD

Analysis Generated

Jul 02, 2026 - 15:39 vuln.today

DescriptionCVE.org

A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application to escalate privileges on the host device.

AnalysisAI

Privilege escalation in Ubiquiti's UniFi Protect Application is possible through an authenticated SQL injection (CWE-89) reachable by a low-privileged user with network access, letting that attacker escalate privileges on the underlying host device with full confidentiality, integrity, and availability impact. The flaw was reported through HackerOne and disclosed in Ubiquiti Security Advisory Bulletin 066; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. With CVSS 8.8 (AV:N/AC:L/PR:L) it is a high-priority patch for any exposed NVR/Protect deployment.

Technical ContextAI

UniFi Protect is Ubiquiti's video surveillance/NVR application that runs on UniFi appliances (UniFi OS Consoles such as the Cloud Key, Dream Machine/Dream Wall, and Network Video Recorders) and manages cameras through a web/mobile interface backed by a local database. The affected component per the CPE is cpe:2.3:a:ubiquiti_inc:unifi_protect_application, indicating the server-side application rather than camera firmware. The root cause is CWE-89 (improper neutralization of special elements in an SQL command): user-controllable input reachable by an authenticated low-privilege account is concatenated into a database query without adequate parameterization, allowing query manipulation. Because the database process and application run on the appliance host with elevated privileges, successful injection is leveraged to escalate privileges on the host device itself rather than merely reading application data.

RemediationAI

Patch available per vendor advisory: upgrade the UniFi Protect Application to the fixed version documented in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); the exact fixed version is not enumerated in the provided input, so confirm the target build directly from that advisory before scheduling. Enable automatic updates on UniFi OS Consoles so the Protect application receives the patched build. Until patched, reduce exposure by ensuring the Protect web interface is not reachable from the internet (place it behind VPN and restrict management access to trusted network segments), and minimize and audit low-privilege Protect accounts since PR:L exploitation depends on holding a valid account - removing shared or unnecessary viewer accounts and rotating credentials of any suspected-compromised users directly shrinks the attack surface, at the cost of some administrative convenience for delegated camera viewing.