CVE-2026-54401

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-54401
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.

7.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:enterprise_fortress_gateway:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_express_7:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloudkey_enterprise:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_gateway_ultra:-:*:*:*:*:*:*:*

Configuration 23 (hide)

AND
cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:*

Configuration 24 (hide)

AND
cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:*

Configuration 25 (hide)

AND
cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:*

Configuration 26 (hide)

AND
cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_2:-:*:*:*:*:*:*:*

Configuration 27 (hide)

AND
cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_4:-:*:*:*:*:*:*:*

Configuration 28 (hide)

AND
cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_pro:-:*:*:*:*:*:*:*

Configuration 29 (hide)

AND
cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_pro_4:-:*:*:*:*:*:*:*

Configuration 30 (hide)

AND
cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_pro_8:-:*:*:*:*:*:*:*

Configuration 31 (hide)

AND
cpe:2.3:o:ui:enterprise_firewall_core_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:enterprise_firewall_core:-:*:*:*:*:*:*:*

Configuration 32 (hide)

AND
cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:*
History

10 Jul 2026, 02:50

Type Values Removed Values Added
References () https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc - () https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc - Vendor Advisory
CPE cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_pro_4:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_gateway_ultra:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloudkey_enterprise:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_4:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_pro:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_express_7:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:enterprise_fortress_gateway:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:*
cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_pro_8:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_2:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:enterprise_firewall_core_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:enterprise_firewall_core:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:*
First Time Ui unifi Dream Machine Beast
Ui unifi Cloud Gateway Max Firmware
Ui unifi Dream Machine Pro Firmware
Ui enterprise Network Video Recorder Core
Ui unifi Dream Wall
Ui unifi Dream Machine Pro Max
Ui unas Pro
Ui unifi Cloud Gateway Ultra Firmware
Ui enterprise Fortress Gateway Firmware
Ui unifi Cloud Gateway Fiber Firmware
Ui unas 2 Firmware
Ui unifi Cloudkey
Ui unifi Cloudkey Enterprise
Ui unifi Dream Wall Firmware
Ui unifi Network Video Recorder G2 Firmware
Ui
Ui unifi Cloudkey Firmware
Ui unifi Dream Router 7
Ui enterprise Network Video Recorder
Ui unifi Dream Machine Special Edition Firmware
Ui unifi Network Video Recorder
Ui unifi Cloud Gateway Fiber
Ui unifi Network Video Recorder Pro
Ui unas 4 Firmware
Ui unifi Express 7 Firmware
Ui unifi Network Video Recorder G2 Pro
Ui unifi Cloud Gateway Max
Ui unifi Network Video Recorder Instant
Ui unifi Dream Machine Beast Firmware
Ui unifi Network Video Recorder Firmware
Ui unifi Dream Router Firmware
Ui unifi Dream Machine Firmware
Ui enterprise Firewall Core Firmware
Ui unifi Dream Router 5g Max Firmware
Ui unifi Cloudkey Enterprise Firmware
Ui unas Pro Firmware
Ui unifi Dream Router
Ui unifi Cloud Key Plus
Ui unifi Dream Machine
Ui enterprise Fortress Gateway
Ui unas 4
Ui enterprise Firewall Core
Ui unifi Dream Machine Pro
Ui unifi Os Server
Ui unifi Cloud Key Plus Firmware
Ui unas Pro 4 Firmware
Ui unas Pro 4
Ui unifi Cloud Gateway Ultra
Ui unifi Dream Machine Pro Max Firmware
Ui unifi Network Video Recorder G2 Pro Firmware
Ui unifi Network Video Recorder G2
Ui unifi Dream Machine Special Edition
Ui unas 2
Ui unifi Dream Router 5g Max
Ui unifi Dream Router 7 Firmware
Ui enterprise Network Video Recorder Core Firmware
Ui unifi Cloud Gateway Industrial
Ui unifi Network Video Recorder Instant Firmware
Ui unas Pro 8
Ui unifi Network Video Recorder Pro Firmware
Ui unifi Express 7
Ui unas Pro 8 Firmware
Ui enterprise Network Video Recorder Firmware
Ui unifi Cloud Gateway Industrial Firmware

02 Jul 2026, 15:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-07-02 15:17

Updated : 2026-07-10 02:50

NVD link : CVE-2026-54401

Mitre link : CVE-2026-54401

CVE.ORG link : CVE-2026-54401

JSON object : View

Products Affected

ui

  • unifi_cloud_gateway_industrial_firmware
  • unifi_os_server
  • unifi_cloud_gateway_industrial
  • unifi_network_video_recorder
  • unifi_network_video_recorder_pro_firmware
  • unifi_network_video_recorder_instant_firmware
  • unas_4_firmware
  • unifi_cloudkey
  • unas_4
  • unifi_dream_machine_special_edition_firmware
  • unifi_dream_machine_firmware
  • unifi_network_video_recorder_g2_pro
  • unas_2_firmware
  • unas_pro_8
  • unifi_express_7_firmware
  • unifi_dream_router_5g_max
  • unifi_network_video_recorder_firmware
  • enterprise_network_video_recorder_firmware
  • enterprise_firewall_core_firmware
  • unifi_dream_router_7
  • unifi_cloud_key_plus
  • unifi_cloud_gateway_ultra
  • unas_pro_firmware
  • enterprise_firewall_core
  • unifi_network_video_recorder_g2_firmware
  • enterprise_network_video_recorder
  • unifi_cloud_gateway_max_firmware
  • unifi_dream_machine_special_edition
  • unifi_cloudkey_enterprise
  • enterprise_fortress_gateway_firmware
  • unifi_network_video_recorder_pro
  • unas_2
  • enterprise_network_video_recorder_core
  • unas_pro
  • unifi_network_video_recorder_g2_pro_firmware
  • unifi_dream_router_7_firmware
  • unas_pro_4_firmware
  • unas_pro_8_firmware
  • unifi_cloudkey_enterprise_firmware
  • unifi_dream_machine_pro_max
  • unifi_cloud_gateway_fiber
  • unas_pro_4
  • unifi_dream_wall_firmware
  • unifi_dream_machine_pro
  • unifi_dream_machine_beast
  • unifi_dream_router
  • unifi_network_video_recorder_instant
  • unifi_cloud_gateway_max
  • unifi_dream_wall
  • unifi_dream_machine_pro_firmware
  • unifi_dream_router_firmware
  • unifi_cloud_key_plus_firmware
  • unifi_dream_router_5g_max_firmware
  • unifi_express_7
  • enterprise_fortress_gateway
  • enterprise_network_video_recorder_core_firmware
  • unifi_dream_machine_pro_max_firmware
  • unifi_cloud_gateway_ultra_firmware
  • unifi_network_video_recorder_g2
  • unifi_cloudkey_firmware
  • unifi_dream_machine_beast_firmware
  • unifi_dream_machine
  • unifi_cloud_gateway_fiber_firmware
CWE
CWE-918

Server-Side Request Forgery (SSRF)