🚨Critical - Ubiquiti UniFi: Command Injection in UniFi OS + Privilege Escalation in UniFi Access (CVE-2026-54402, CVE-2026-54400) Ubiquiti's SA Bulletin 066 covers two critical flaws. CVE-2026-54402 is an improper input validation issue in UniFi OS that leads to command injection on the host: a network-adjacent attacker with low privileges can inject and execute arbitrary OS commands on the device. It affects a broad range of UniFi hardware -Dream Machines/Routers/Wall, Cloud Gateways, Cloud Keys, NVR/EVR, NAS, Enterprise Firewall Core, and more. CVE-2026-54400 is an improper access control flaw in the UniFi Access Application allowing privilege escalation on the host, exploitable by a network-adjacent actor who already holds high privileges. Both are remotely exploitable with no user interaction and result in full host compromise. 👉Update UniFi OS to 5.1.19 and UniFi Access Application to 4.2.29.
Post summary
Ubiquiti’s Security Advisory 066 discloses two critical vulnerabilities—command injection (CVE-2026-54402) and privilege escalation (CVE-2026-54400)—in UniFi OS and Access Application that are remotely exploitable without user interaction, and it directs users to upgrade to specific patched versions.
