UniFi Access EUVD-2026-66402

Exploitation requires the attacker to have network access to the UniFi Access Application and to already possess low-privilege (authenticated, PR:L) credentials on that application - it is not exploitable by a fully unauthenticated actor per the CVSS vector. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a valid low-privilege account and network reachability to the application exist, no special non-default configuration is described as necessary. The primary limiting factors are therefore the need for a foothold account and network-level reachability to the vulnerable UniFi Access host; restricting either substantially reduces exploitability.

The signals are only partially populated: CVSS 3.1 is 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a low-complexity network attack requiring only low privileges and no user interaction, with scope change yielding total confidentiality, integrity, and availability loss on the host. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified and there is no evidence of active or automatable exploitation. The high score is driven primarily by the scope-change-to-host and full-impact triad; the PR:L requirement (an attacker must already hold a valid low-privilege UniFi Access account) is the main real-world limiter. Treat this as a high-priority patching target given the near-maximal CVSS and vendor confirmation, while noting that absence of EPSS/KEV means widespread opportunistic exploitation is not yet demonstrated.

An attacker who has obtained or been granted a low-privilege UniFi Access Application account - for example a limited operator login - sends crafted requests over the network to functionality that fails to enforce proper authorization. By bypassing those access-control checks the attacker escalates from the constrained application context to privileges on the host device, gaining full control of the access-control server and, potentially, the doors and entry systems it manages. No public exploit code has been identified, and low attack complexity means no unusual timing or configuration is required once a foothold account exists.