UniFi Protect CVE-2026-56841

Exploitation requires an authenticated low-privileged account on the UniFi Protect Application (CVSS PR:L) with network reachability to the Protect interface (AV:N); no user interaction is required (UI:N) and attack complexity is low (AC:L). The concrete prerequisite is possession of valid credentials for a low-privilege Protect user (e.g., a limited/viewer role) plus the ability to reach the vulnerable application endpoint over the network. Limiting factors: the attacker cannot exploit fully unauthenticated, so exposure depends on how many low-privilege accounts exist and whether the Protect interface is network-restricted; deployments that keep Protect behind a VPN or isolated management VLAN and tightly control account provisioning materially raise the bar.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8, High) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high impact across all three security properties - a strong signal for prioritization. However, PR:L means the attacker must first hold a valid low-privileged account on the Protect application, which limits fully anonymous exploitation and points toward an insider, compromised-credential, or multi-stage scenario. No EPSS score, SSVC decision, or KEV status was provided in the input, and no POC is referenced, so exploitation probability cannot be quantified from the data; the absence of KEV and POC suggests no confirmed active exploitation at this time. The realistic priority is high for internet-exposed or multi-tenant Protect consoles where low-privilege accounts exist, and moderate for isolated deployments where console access is tightly controlled.

An attacker who has obtained a low-privileged UniFi Protect account (for example a viewer credential that was phished, reused, or shared) sends crafted input to a vulnerable Protect endpoint over the network, injecting SQL that manipulates the backend query. Because the database runs on the appliance with elevated context, the attacker leverages the injection to escalate to host-level privileges on the UniFi console/NVR. No public POC is referenced, but the low attack complexity and lack of required user interaction make reliable exploitation plausible once credentials are held.