Vulnerability · Published Mar 19, 2026 · Assigned by hackerone
CVE-2026-22557
Critical 10.0
In plain English
A critical-severity path traversal in UniFi Network Application from Ubiquiti Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 28.7% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)28.7%top 1.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC
Official description
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ubiquiti Inc | UniFi Network Application | 10.1.89 – before 10.1.8910.2.97 – before 10.2.979.0.118 – before 9.0.118 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H