UniFi Access EUVD-2026-41386

Exploitation requires the attacker to already hold high privileges within the UniFi Access Application (CVSS PR:H) and to have network reachability to the application/management interface (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The key limiting factor is the PR:H prerequisite - this is not a remote-unauthenticated flaw: an attacker must first be a privileged/authenticated actor in UniFi Access, so it functions as a privilege-escalation-from-admin-to-host issue rather than an external breach primitive. There is no indication of a special non-default configuration requirement beyond having UniFi Access deployed and network-accessible.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1 Critical) shows a network-reachable, low-complexity attack requiring no user interaction but requiring high existing privileges (PR:H). The high score is inflated primarily by the scope change (S:C) and full CIA impact on the host, but PR:H is a meaningful gate - the attacker must already be a privileged/authenticated actor within UniFi Access, which sharply narrows the realistic attacker population to insiders or someone who has already compromised a privileged account. No EPSS score was provided, no KEV listing exists, and no POC is referenced, so despite the 9.1 rating the real-world exploitation likelihood cannot be quantified and appears lower than the raw number suggests for well-segmented deployments. The primary risk is lateral/vertical escalation from control of the access-management app to control of the host device itself, which is severe where UniFi Access governs physical door access.

An attacker who has obtained a high-privilege UniFi Access account (e.g., a rogue administrator or an adversary who phished/reused admin credentials) connects over the network to the management interface and abuses the improper access control flaw to execute actions against the underlying host device, escalating from application admin to host-level control. Because the scope changes, the attacker can then manipulate the device that enforces physical door access. No public POC is referenced, so exploitation would require the attacker to develop the technique independently.