EUVD-2026-66368
GHSA-p837-q6jq-7f9v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with existing high-privilege account
-
DeliveryReach UniFi Network Application over network
-
ExploitInvoke improperly-restricted privileged function
-
ExecutionBypass authorization boundary
-
PersistEscalate to full application control
-
ImpactReconfigure or disrupt managed network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already be an authenticated user holding high privileges (PR:H) within the UniFi Network Application, with network reachability to the controller (AV:N); no end-user interaction is needed (UI:N) and attack complexity is low (AC:L). The concrete prerequisite is possession of (or takeover of) a high-privilege controller account - this is the primary limiting factor, making the flaw realistically an insider or post-compromise escalation vector rather than a pre-auth remote exploit. Note the vendor's 'Authentication Bypass' tag conflicts with the PR:H metric; if the bulletin confirms a genuine pre-authentication path, the prerequisite bar is lower than the CVSS vector implies - verify against Ubiquiti Security Advisory Bulletin 067. |
| Impact | The signals are mixed. The CVSS base score of 9.1 is high, but the vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) shows the severity is inflated primarily by the scope-change (S:C) and full CIA impact, while PR:H means the attacker must already possess high privileges - a limiting factor a raw 9.1 obscures. No EPSS, POC, or KEV data was provided, so there is no evidence of active or imminent exploitation; realistically this is an insider or post-compromise escalation issue rather than an internet-facing unauthenticated exploit. The 'Authentication Bypass' tag appears to conflict with PR:H (which implies valid high-privilege authentication is required) - this discrepancy should be verified against the vendor bulletin, as it materially changes whether the flaw is reachable without credentials. Priority is moderate-to-high for deployments with many admin-tier users, lower for tightly-held single-operator controllers. |
| Exploit ScenarioDerived | A user who already holds a high-privilege (e.g., limited-admin or site-admin) role on the UniFi Network Application connects over the network and abuses the improper access control flaw to escalate to full application control, letting them alter configurations, exfiltrate managed-device data, or disrupt the network. No user interaction is required (UI:N) and complexity is low (AC:L), but the attacker must first possess valid high privileges; no public exploit code is currently available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Privilege escalation in Ubiquiti's UniFi Network Application allows an already-authenticated, high-privileged user with network access to gain elevated rights within the application through an improper access control (CWE-284) flaw. Ubiquiti self-reported the issue in Security Advisory Bulletin 067 and tags it as an authentication bypass; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor rates it CVSS 9.1, driven largely by an assumed scope change, though the practical bar is raised by the requirement for pre-existing high privileges.
RemediationAI
Upgrade the UniFi Network Application to the fixed release identified in Ubiquiti Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9); an exact fixed version number is not present in the provided data, so treat this as Patch available per vendor advisory and confirm the target build from that bulletin before deploying. Until patched, reduce exposure by minimizing the number of accounts granted high/administrative roles, auditing existing admin and site-admin assignments for least privilege, and restricting network reachability of the controller's management interface (typically ports 8443/8080/443) to a trusted management VLAN or VPN so only vetted operators can reach it - the trade-off is added friction for legitimate remote administration. Enable multi-factor authentication on controller accounts and review admin activity logs for anomalous privilege use, since the flaw is only reachable by users who already hold elevated access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UniFi Network Application is Ubiquiti's centralized controller software (self-hosted or Cloud Key / UniFi OS hosted) used to provision, monitor, and manage UniFi switches, access points, gateways, and clients. The root cause is CWE-284 Improper Access Control: the application fails to correctly enforce authorization boundaries between privilege levels, so a user who already holds an administrative or otherwise high-privilege role can reach actions or resources reserved for a higher trust tier. The single CPE, cpe:2.3:a:ubiquiti_inc:unifi_network_application:*:*:*:*:*:*:*:*, is version-wildcarded, so NVD does not pin an exact affected build range - the vendor bulletin is authoritative for versions.
Know when Unifi Network Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires a pre-existing high-privilege account so PR:H; escalation stays within the same application so I assess S:U (vendor used S:C), with full CIA loss over the controller giving C:H/I:H/A:H.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.
Executive ViewAI
Ubiquiti UniFi Network Application contains a privilege escalation vulnerability (CVE-2026-77541, CVSS 9.1) allowing already-authenticated administrative users to escalate to complete application control, potentially compromising the security of critical network infrastructure. Organizations operating UniFi deployments face risk of administrative account misuse or compromise leading to unauthorized modification of network policies and security configurations.
No vendor-released patch identified at time of analysis. Implement network segmentation restricting UniFi application access to trusted administrative networks; enforce multi-factor authentication for all administrative accounts; monitor and log all administrative activities with real-time alerting on privilege escalation; maintain immutable audit trails of configuration changes; consider temporary restrictions on high-privilege account functionality if operationally feasible pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Unifi Network Application
View allA critical path traversal vulnerability exists in the UniFi Network Application that allows unauthenticated remote attac
Authenticated command injection in Ubiquiti's UniFi Network Application (the controller software managing UniFi network
A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems
Privilege escalation in Ubiquiti's UniFi Network Application allows a low-privileged, network-adjacent user to gain elev
Privilege escalation via path traversal in self-hosted UniFi Network Application (Ubiquiti's controller software) allows
Privilege escalation in Ubiquiti's UniFi Network Application allows a low-privileged, authenticated user on the network
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (V
Privilege persistence in Ubiquiti's UniFi Network Application allows a low-privileged network-adjacent actor to retain g
Denial of service in Ubiquiti's UniFi Network Application allows a remote, unauthenticated attacker with network access
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. Rated
A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor
Exploit-DB