EUVD-2026-41398
GHSA-9prq-fx52-ppcv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable SSRF exploitable by a low-privilege account (PR:L) with no interaction, escalating across a scope boundary (S:C) to full host compromise, giving C:H/I:H/A:H.
Primary rating from Vendor (hackerone).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device.
Articles & Coverage 1
AnalysisAI
Privilege escalation via Server-Side Request Forgery in Ubiquiti's UniFi Protect Application allows a low-privileged, network-adjacent attacker to coerce the application into making attacker-controlled requests and escalate to control of the host device. The CVSS 9.9 rating is driven by a scope change (S:C) plus full confidentiality, integrity, and availability impact, meaning the SSRF crosses a security boundary from the application into the underlying host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Technical ContextAI
UniFi Protect is Ubiquiti's video surveillance/NVR management application that runs on UniFi appliances (e.g., UDM/UNVR consoles) and coordinates cameras, storage, and network access. The root cause is CWE-918 (Server-Side Request Forgery): the application accepts a user-influenced URL or destination and issues a server-side request without adequate validation, letting an attacker reach internal endpoints, metadata services, or privileged local interfaces that are otherwise unreachable. Per the CPE (cpe:2.3:a:ubiquiti_inc:unifi_protect_application:*), all versions prior to the advisory fix are implicated, though the exact fixed version is not enumerated in the provided data.
RemediationAI
Apply the update referenced in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); this is patch available per vendor advisory, but the exact fixed version is not stated in the available data, so verify and install the version named in that bulletin. Because UniFi Protect commonly auto-updates, confirm your console/appliance firmware and the Protect application both report the patched build. Until patched, restrict who holds low-privilege accounts on the Protect application and limit network reachability of the Protect management interface to trusted administrative networks/VLANs, since exploitation requires network access plus a low-privilege foothold; note that tightening account access and network segmentation may disrupt legitimate remote operators and integrations, so stage changes carefully.
More in Unifi Protect Application
View allCommand injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary ope
Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrar
Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged c
Authentication bypass in Ubiquiti's UniFi Protect Application (versions before 7.1.83) allows a network-adjacent attacke
Privilege escalation in Ubiquiti's UniFi Protect Application is possible through an authenticated SQL injection (CWE-89)
Authentication bypass in Ubiquiti UniFi Protect Application lets a network-adjacent attacker reach certain API endpoints
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacke
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today