UniFi Protect EUVD-2026-41398

Exploitation requires network access to the UniFi Protect Application's management interface and an authenticated low-privilege account (CVSS PR:L), so this is not an unauthenticated remote flaw - the attacker must first hold or obtain a limited Protect user login. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a low-privilege foothold and network reachability exist, no special non-default configuration is documented as necessary. The primary limiting factors are the need for that valid low-privilege credential and network-layer reachability to the Protect application; segmentation of the management interface and strict account provisioning meaningfully reduce the realistic attack surface.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) presents a high-priority profile: network-reachable, low attack complexity, only low privileges required, no user interaction, and a scope change yielding full host compromise. The scope change combined with the description's 'escalate privileges on the host device' is the key amplifier - an SSRF that pivots to host takeover is materially more dangerous than a typical read-only SSRF. However, PR:L means the attacker must already hold some authenticated low-privilege foothold, which narrows the population of realistic attackers versus a pure unauthenticated bug. EPSS is not provided and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation; treat the 9.9 as a strong patch-priority signal tempered by the authentication prerequisite. No POC or exploit code was referenced, so real-world exploitation likelihood is currently unquantified.

An attacker who has obtained a low-privileged UniFi Protect account (for example a limited operator login) sends a crafted request that causes the Protect application to issue a server-side request to an internal or local privileged endpoint on the host. By steering that request, the attacker abuses the scope change to reach services running with higher privilege and escalates to control of the underlying device. No public POC is referenced, but the low complexity (AC:L) and lack of required user interaction make this straightforward once an initial account is held.