CVE-2026-22557Patch

CRITICALCVSS 10.0 · CRITICAL

Exploitation observed; activity peaked at 18 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.

Back to dashboard

8.3/ 10 priority

Sources & remediation

Other references

https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b

Weakness type (CWE)

CWE-22

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Active exploitation appears in 2 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
55 mentions across 14 observed days

What's happening

Active exploitation reported across 2 signals
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 23 signals
Technical details provided in 42 signals
Disclosure: 19 classified signals
General: 13 classified signals
Peaked 12d ago at 18 mentions (2026-03-19); latest day: 1
55 total mentions across 14 days

Deep dive

Activity timeline55 mentions / 14d

Signal classification5 categories

Patch

2036.4%

Disclosure

1934.5%

General

1323.6%

PoC

23.6%

Active Exploitation

11.8%

Referenced assets26 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-18	3	Disclosure1General1Patch1
2026-03-19	18	Disclosure7General2Patch9
2026-03-20	9	Disclosure5General1Patch3
2026-03-21	5	Active Exploitation1Disclosure1General1Patch2
2026-03-23	3	Disclosure1General1Patch1
2026-03-25	1	Disclosure1
2026-03-26	1	Disclosure1
2026-03-27	1	Patch1
2026-04-10	3	Patch3
2026-05-10	5	Disclosure2General3
2026-05-31	1	General1
2026-06-08	3	General3
2026-08-09	1	PoC1
2026-08-15	1	PoC1

Full discourse20 posts

International Cyber Digest@IntCyberDigest205d
Disclosure
🚨‼️ CRITICAL: Ubiquiti UniFi Network Application vulnerabilities were just disclosed CVE-2026-22557 CVSS 10.0 Remote path traversal vulnerability allowing an attacker to access and manipulate files, leading to account takeover. No authentication required. CVE-2026-22558 — CVSS 7.7 Authenticated NoSQL Injection allowing privilege escalation.
Post summary
Two new Ubiquiti UniFi Network Application vulnerabilities have been disclosed: CVE‑2026‑22557 (remote path traversal, CVSS 10.0) and CVE‑2026‑22558 (authenticated NoSQL injection, CVSS 7.7).
42334372.1K846308.0K
99.6K followersView on X
Ezequiel Librandi@EzeLibrandi205d
Patch
🚨ATENCIÓN GORDOS UBIQUITI!!! Actualicen Unifi Network Application: se publicaron 2 vulnerabilidades, una de ellas CRÍTICA! - CVE-2026-22557 (10.0): Remote Path Traversal que permitiría a un atacante acceder y manipular archivos, e incluso comprometer cuentas sin autenticación. - CVE-2026-22558 (7.7): NoSQL Injection que permitiría escalar privilegios (requiere autenticación). Como mitigarlo? - Release (estable): actualizar a 10.1.89+ - Release Candidate: actualizar a 10.2.97+ - UniFi Express (UX): actualizar firmware a 4.0.13+ (incluye UniFi Network 9.0.118+)
Post summary
The post announces two critical vulnerabilities (CVE‑2026‑22557 and CVE‑2026‑22558) in Ubiquiti UniFi Network Application and urges users to update to specified firmware releases to mitigate them.
75022159128.6K
1.8K followersView on X
ثامر الغالي@alghali205d
Disclosure
🚨‼️ تحذير أمني حرج: تم الكشف للتو عن ثغرات خطيرة في تطبيق الشبكات Ubiquiti UniFi Network! 🔴 CVE-2026-22557 (تقييم CVSS 10.0 - خطورة قصوى) ثغرة اختراق مسار عن بُعد (Remote Path Traversal) تسمح للمهاجم بالوصول للملفات وتعديلها، مما يؤدي للاستيلاء الكامل على الحساب (لا تتطلب أي مصادقة!). 🟠 CVE-2026-22558 (تقييم CVSS 7.7 - خطورة عالية) ثغرة حقن (NoSQL Injection) تتطلب مصادقة مسبقة، وتسمح للمهاجم برفع مستوى الصلاحيات. يرجى تحديث أنظمتكم فوراً لتجنب الاختراق! 🛡️💻
Post summary
The post announces the discovery of two critical vulnerabilities in Ubiquiti UniFi Network, detailing CVSS scores, types, and impact, but does not provide exploit code, coverage of active exploitation, or specific patch information.
260524513.5K
86.4K followersView on X
Censys@censysio205d
Patch
🚨Critical vulnerability: CVE-2026-22557 CVSS 10.0 unauthenticated remote path traversal vulnerability in Ubiquiti UniFi Network Application. ⚠️ An attacker could access and manipulate system files with potential for account takeover 🔎 Censys ARC sees 87,196 exposed hosts 🛠️ Patches are available - patch immediately 👉 Full advisory: https://hubs.ly/Q047CPM40 #CVE202622557 #infosec
Post summary
The post announces CVE‑2026‑22557, a critical unauthenticated remote path traversal flaw in Ubiquiti UniFi Network Application, and urges users to apply the available patch as soon as possible.
121049163.8K
12.0K followersView on X
Gray Hats@the_yellow_fall205d
Patch
Ubiquiti warns of a critical 10.0 CVSS Path Traversal flaw (CVE-2026-22557) in UniFi Network Applications allowing total system takeover. Patch immediately. #Ubiquiti #UniFi #CVE #CyberSecurity #NetworkSecurity #InfoSec #Vulnerability #PathTraversal https://securityonline.info/total-takeover-critical-10-cvss-flaw-ubiquiti-unifi-networks-cve-2026-22557/ https://t.co/LsDDMRiYDk
Post summary
Ubiquiti has issued a critical alert for CVE-2026-22557, a CVSS‑10.0 Path Traversal flaw that could allow total system takeover, and urges immediate patching.
080204962
10.7K followersView on X
IT-Connect.fr@ITConnect_fr204d
General
🛑 Ubiquiti – CVE-2026-22557 : cette faille critique menace votre réseau UniFi Ma publication à ce sujet 👇 - https://www.it-connect.fr/ubiquiti-cve-2026-22557-cette-faille-critique-menace-votre-reseau-unifi/ #ubiquiti #infosec #cybersecurite #reseau https://t.co/q5bjT2Oe2f
Post summary
The tweet warns that CVE-2026-22557 is a critical flaw threatening UniFi networks, but it provides no specific details on exploitation, mitigation, or technical aspects.
1601862.5K
11.0K followersView on X
yousukezan@yousukezan205d
Patch
UniFi Network Applicationに深刻な欠陥が見つかり、認証不要でシステムを完全掌握される恐れが浮上した。家庭や企業で広く使われる機器が対象で、早急な更新が強く求められている。 Ubiquitiは同アプリに存在する2件の脆弱性を公表した。中でもCVE-2026-22557はCVSS10.0のクリティカルなPath Traversalで、ネットワークに接続可能な攻撃者が制限外のファイルへアクセスできる。これにより内部ファイルの改変やアカウント乗っ取りが可能となり、管理機能全体の制御権を奪われる危険がある。もう一つのCVE-2026-22558はNoSQLインジェクションで、認証済みユーザーが権限昇格できる問題だ。データベースクエリへ不正コードを注入することで管理者権限を取得し、ネットワーク全体に影響を及ぼす可能性がある。影響はUniFi Expressや各リリース系に広がり、旧バージョンの利用は極めて危険とされる。Ubiquitiは修正版を公開し、速やかなアップデートを強く推奨している。 https://securityonline.info/total-takeover-critical-10-cvss-flaw-ubiquiti-unifi-networks-cve-2026-22557/
Post summary
The article announces two critical vulnerabilities in Ubiquiti UniFi networks—CVE‑2026‑22557 (path traversal, CVSS 10.0) and CVE‑2026‑22558 (NoSQL injection privilege escalation)—and reports that a vendor patch is available with a strong recommendation for immediate update.
080731.9K
12.0K followersView on X
Endless Router Bugs@router_bugs56d
PoC
This is a game over bug for Ubiquiti , on default installs, an attacker even on a guest network, could grab JWT keys and become admin. https://github.com/UntestedFeasibility/Untested_Feasibility/tree/main/CVE-2026-22557 by @izn0u "critical unauthenticated path traversal vulnerability in the Ubiquiti UniFi Guest Portal"
Post summary
The post reveals a critical default‑install path traversal flaw in Ubiquiti UniFi Guest Portal that lets attackers steal JWT keys to gain admin rights, and shares a GitHub proof‑of‑concept script.
03042549
163 followersView on X
iznou@izn0u62d
PoC
#CVE-2026-22557 A common misconception is that the controller is only exploitable when a site runs a customized guest portal. This is incorrect. It can be exploited without a customized guest portal through the default endpoint: https://github.com/UntestedFeasibility/Untested_Feasibility/tree/main/CVE-2026-22557
Post summary
The post confirms CVE‑2026‑22557 is exploitable through the default endpoint and supplies a GitHub link to proof‑of‑concept code, debunking a prior misconception about required custom portals.
12131166
45 followersView on X
Ananay@ananayarora205d
General
This is the THIRD CVS 10.0 vulnerability for UniFi in the past year CVE-2025-23123, CVE-2025-52665, CVE-2026-22557.
Post summary
The post merely lists three CVE identifiers for UniFi without additional context or technical details.
10060904
13.1K followersView on X
Günter Born@etguenni205d
Patch
Setzt jemand die Ubiquiti UniFi Network Application ein? Es gibt zwei Schwachstellen CVE-2026-22557 (CVSS 3.1 10.0, ermöglicht Kontenübernahme), CVE-2026-22558 (CVSS 3.1 7.7 ermöglicht Rechteerweiterung) - patchen. https://borncity.com/blog/2026/03/19/ubiquiti-unifi-network-application-schwachstellen-cve-2026-22557-cve-2026-22558/
Post summary
The post alerts users to two high‑severity Ubiquiti UniFi Network Application CVEs, providing technical details and urging immediate patching, but offers no PoC, exploit code, or evidence of active exploitation.
01040448
2.6K followersView on X
CCB Alert@CCBalert204d
Disclosure
Warning: CVE‑2026‑22557 (Critical) & CVE‑2026‑22558 (High) in #UniFi Network App could lead to full system compromise. More info in https://ccb.belgium.be/advisories/warning-cve-2026-22557-cve-2026-22558-unifi-network-app-could-lead-full-system #patch #patch #patch
Post summary
The notice alerts on CVE‑2026‑22557 and CVE‑2026‑22558 in UniFi Network App as potentially enabling full system compromise, but provides no exploit details, patches, or technical specifics.
01002293
7.2K followersView on X
Fluttershy Bubbles@artificestultio205d
General
@IntCyberDigest How is CVE-2026-22557 a 10.0? It should be AV:A if the attached has to be on your network.
Post summary
The tweet comments on the CVE’s severity rating but provides no evidence of exploitation or remediation.
10010916
7 followersView on X
TheTechWorldPodcast@TheTechWorldPod205d
Patch
CRITICAL Ubiquiti UniFi Network Application Vulnerabilities Disclosed Security Advisory Bulletin 062 – Published: March 18, 2026 These vulnerabilities affect the UniFi Network Application (the controller software for managing UniFi networking devices). 1. CVE-2026-22557 – Remote Path Traversal (Critical – CVSS 10.0) - Discovered by: n00r3 (@izn0u) - Severity: Critical - CVSS v3.1 Base Score: 10.0 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Attack Vector: Network (remote, over the internet or local network) - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact: High on Confidentiality, Integrity, and Availability - Description: A path traversal vulnerability allows a malicious actor with network access to exploit directory traversal sequences (e.g., ../ patterns) in affected endpoints. This enables arbitrary file access and manipulation on the underlying host operating system running the UniFi Network Application. Successful exploitation can lead to reading sensitive files (configuration, credentials, logs), writing malicious files, or modifying system files in ways that facilitate full account takeover, remote code execution, or persistent access. - Authentication Required: None (unauthenticated remote attack possible if the UniFi controller's web interface or API is exposed) - Affected Versions: - Official Release: UniFi Network Application Version 10.1.85 and earlier - Release Candidate: UniFi Network Application Version 10.2.93 and earlier - Status: Actively exploitable in the wild (high risk if controller is internet-facing or on an untrusted network) - Recommendation: Immediate patching required 2. CVE-2026-22558 – Authenticated NoSQL Injection (High – CVSS 7.7) - Discovered by: Garett Kopcha (@0x5t) - Severity: High - CVSS v3.1 Base Score: 7.7 (High) - Description: An authenticated NoSQL injection vulnerability exists in the UniFi Network Application. A malicious actor with valid credentials (e.g., a compromised low-privilege user account) can inject malicious payloads into NoSQL database queries. This allows privilege escalation, potentially granting administrative or root-level access within the application or on the host system, depending on the query context and database permissions. - Authentication Required: Yes (requires valid authenticated access to the UniFi Network Application) - Attack Vector: Network - Impact: Privilege escalation; could lead to full compromise of the controller, device management takeover, or lateral movement in the network - Affected Versions: Same as above (UniFi Network Application Version 10.1.85 and earlier / RC 10.2.93 and earlier) Mitigation / Recommended Actions (from official advisory): - Update immediately to the latest stable version of UniFi Network Application (Version 10.2.x or newer stable release that supersedes the affected versions – check the Ubiquiti release notes or http://community.ui.com for the exact patched build). - If your controller is internet-facing: Restrict access via firewall rules, VPN-only access, or place it behind a reverse proxy with strong authentication. - Monitor for unusual login attempts, file access anomalies, or unexpected privilege changes. - Apply network segmentation: Isolate the management VLAN/subnet from untrusted devices. - Reference: Official advisory – https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b Patch as soon as possible – especially CVE-2026-22557, which is unauthenticated and scores a full 10.0 CVSS.
Post summary
The advisory discloses two critical Ubiquiti UniFi Network Application vulnerabilities (CVE‑2026‑22557 and CVE‑2026‑22558), details their technical impact, and urges users to apply immediate patches to version 10.2.x or newer, as the vulnerabilities are actively exploitable in the wild.
00101340
697 followersView on X
Sami Laiho@samilaiho132d
General
Looting UniFi Controllers: Detecting and Weaponizing CVE-2026-22557 https://bishopfox.com/blog/looting-unifi-controllers-detecting-and-weaponizing-cve-2026-22557
Post summary
The post discusses detecting and weaponizing CVE‑2026‑22557 on UniFi controllers but does not provide concrete evidence of exploitation, a PoC, patch, or false‑positive claim.
00001484
30.6K followersView on X
Lucas@lucasverdan183d
Patch
🛑 CVE-2026-22557 puts internet-exposed UniFi controllers at account-takeo… Ubiquiti patched CVE-2026-22557, a CVSS 10.0 UniFi Network Application flaw that can enable… 🔗 Details → https://invaders.ie/resources/blog/vulnerability/cve-2026-22557-unifi-controller-account-takeover-risk
Post summary
Ubiquiti has released a patch for CVE‑2026‑22557, a critical (CVSS 10.0) flaw in UniFi controllers that could allow account takeover; no exploit code or active attacks are reported.
0001083
307 followersView on X
iototsecnews@iototsecnews198d
Disclosure
Ubiquiti UniFi の脆弱性に CVE-2026-22557／22558 が FIX：深刻なパス・トラバーサルと NoSQLi https://iototsecnews.jp/2026/03/19/critical-ubiquiti-unifi-vulnerabilities-allow-attackers-to-seize-full-control-of-underlying-systems/ Ubiquiti の UniFi Network Application における 2 件の深刻な脆弱性、 CVE-2026-22557／CVE-2026-22558 について解説する記事です。1 つ目の脆弱性 CVE-2026-22557 の原因は、アプリケーション内のファイルパス処理における不備 (パス・トラバーサル) にあります。本来アクセスできる範囲を超えて、 OS 上の機密ファイルまで読み書きできてしまう状態にあります。認証すら不要で、ネットワーク経由でシステム全体の制御を奪われる恐れがあるため、 CVSS スコアは最高値の 10.0 と評価されています。もう一つの脆弱性 CVE-2026-22558 の原因は、データベース操作時の入力検証不足による NoSQL インジェクションです。すでに低権限でログインしている攻撃者が、悪意のあるクエリを注入することで、管理権限へと昇格できてしまいます。インターネットから管理画面へのアクセスが可能になっている場合には、きわめて高いリスクがあるため、優先的なパッチ適用が必要とされています。 #CVE202622557 #CVE202622558 #Ubiquiti #UniFi #Vulnerability
Post summary
The article discloses two critical Ubiquiti UniFi vulnerabilities (CVE-2026-22557 path traversal, CVE-2026-22558 NoSQL injection), details their severity and mechanics, and urges immediate patching.
01000234
481 followersView on X
bigmacd@bigmacd16684200d
Patch
Ubiquiti fixed critical CVE-2026-22557, a path traversal flaw in UniFi Network App v10.1.85 & below allowing account takeover, also CVE-2026-22558, an authenticated NoSQL injection (CVSS 7.7). #CyberSecurity
Post summary
The statement announces that Ubiquiti has released fixes for CVE‑2026‑22557 and CVE‑2026‑22558, along with technical details of the vulnerabilities.
1000011
4 followersView on X
VulnTracker@vuln_tracker204d
Disclosure
@censysio 87,196 exposed hosts for a CVSS 10.0 unauthenticated path traversal. CVE-2026-22557 in Ubiquiti UniFi is a nightmare for network admins worldwide. That Censys ARC map says it all. Don't miss critical CVEs: http://vulntracker.io
Post summary
Censys reports that 87,196 hosts running Ubiquiti UniFi are exposed to the high‑severity CVE‑2026‑22557 path traversal flaw, highlighting the vulnerability’s severity, but no active exploitation or patch information is provided.
00001266
442 followersView on X
Dave@RideToFireStar123d
General
Yawn 🥱 2026 recap: UniFi OS: - CVE-2026-34908 - 10 - CVE-2026-34909 - 10 - CVE-2026-34910 - 10 - CVE-2026-33000 - 9.1 - CVE-2026-34911 - 7.7 UniFi Play Devices: - CVE-2026-22563 - 9.8 - CVE-2026-22562 - 9.8 - CVE-2026-22564 - 9.8 - CVE-2026-22566 - 7.5 - CVE-2026-22565 - 7.5 UniFi Network (Controller): - CVE-2026-22557 - 10 - CVE-2026-22558 - 7.7 - CVE-2026-22559 - 8.8 UniFi Protect: - CVE-2026-21633 - 8.8 - CVE-2026-21634 - 6.5 UniFi airMAX: - CVE-2026-21638 - 8.8 So much fail, and we're not even halfway through 2026. Lots of 10s and 9s. 🤡🩰
Post summary
The post lists several UniFi CVEs with high severity scores but offers no technical details, exploitation evidence, or remediation information.
00000116
1.2K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-22557

International Cyber Digest[verified]@IntCyberDigestDisclosure

Two new Ubiquiti UniFi Network Application vulnerabilities have been disclosed: CVE‑2026‑22557 (remote path traversal, CVSS 10.0) and CVE‑2026‑22558 (authenticated NoSQL injection, CVSS 7.7).

Ezequiel Librandi[verified]@EzeLibrandiPatch

The post announces two critical vulnerabilities (CVE‑2026‑22557 and CVE‑2026‑22558) in Ubiquiti UniFi Network Application and urges users to update to specified firmware releases to mitigate them.

ثامر الغالي[verified]@alghaliDisclosure

The post announces the discovery of two critical vulnerabilities in Ubiquiti UniFi Network, detailing CVSS scores, types, and impact, but does not provide exploit code, coverage of active exploitation, or specific patch information.

Censys[verified]@censysioPatch

The post announces CVE‑2026‑22557, a critical unauthenticated remote path traversal flaw in Ubiquiti UniFi Network Application, and urges users to apply the available patch as soon as possible.

yousukezan[verified]@yousukezanPatch

The article announces two critical vulnerabilities in Ubiquiti UniFi networks—CVE‑2026‑22557 (path traversal, CVSS 10.0) and CVE‑2026‑22558 (NoSQL injection privilege escalation)—and reports that a vendor patch is available with a strong recommendation for immediate update.

Ananay[verified]@ananayaroraGeneral

The post merely lists three CVE identifiers for UniFi without additional context or technical details.

TheTechWorldPodcast[verified]@TheTechWorldPodPatch

The advisory discloses two critical Ubiquiti UniFi Network Application vulnerabilities (CVE‑2026‑22557 and CVE‑2026‑22558), details their technical impact, and urges users to apply immediate patches to version 10.2.x or newer, as the vulnerabilities are actively exploitable in the wild.

Sami Laiho[verified]@samilaihoGeneral

The post discusses detecting and weaponizing CVE‑2026‑22557 on UniFi controllers but does not provide concrete evidence of exploitation, a PoC, patch, or false‑positive claim.