October 22, 2026

CVE Watchtower

← Back to CVE List

CVE-2026-54403NVD

Vulnerability Summary

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.
Severity Level
HIGH(8.6)
Published Date
Jul 2, 2026
Last Modified
Jul 10, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.62%Probability
Root Weakness (CWE)
CWE-22: Path Traversal ↗
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory.
CVSS v3.1 Base Metrics — Score 8.6 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeChanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone

Affected & Patched Versions

Affected Versions
  • Ui Unifi Os Server <= 5.1.15
  • Ui Unifi Dream Machine Firmware <= 5.1.15
  • Ui Unifi Dream Machine Pro Firmware <= 5.1.15
  • Ui Unifi Dream Machine Special Edition Firmware <= 5.1.15
  • Ui Unifi Dream Machine Pro Max Firmware <= 5.1.15
  • Ui Unifi Dream Machine Beast Firmware <= 5.1.15
  • Ui Enterprise Fortress Gateway Firmware <= 5.1.15
  • Ui Unifi Dream Router Firmware <= 5.1.15
  • Ui Unifi Dream Wall Firmware <= 5.1.15
  • Ui Unifi Dream Router 7 Firmware <= 5.1.15
  • Ui Unifi Express 7 Firmware <= 5.1.15
  • Ui Unifi Cloudkey Firmware <= 5.1.15
  • Ui Unifi Cloud Key Plus Firmware <= 5.1.15
  • Ui Unifi Cloudkey Enterprise Firmware <= 5.1.15
  • Ui Unifi Network Video Recorder Firmware <= 5.1.15
  • Ui Unifi Network Video Recorder Pro Firmware <= 5.1.15
  • Ui Unifi Network Video Recorder Instant Firmware <= 5.1.15
  • Ui Enterprise Network Video Recorder Firmware <= 5.1.15
  • Ui Enterprise Network Video Recorder Core Firmware <= 5.1.15
  • Ui Unifi Network Video Recorder G2 Firmware <= 5.1.15
  • Ui Unifi Network Video Recorder G2 Pro Firmware <= 5.1.15
  • Ui Unifi Cloud Gateway Ultra Firmware <= 5.1.15
  • Ui Unifi Cloud Gateway Max Firmware <= 5.1.15
  • Ui Unifi Cloud Gateway Industrial Firmware <= 5.1.15
  • Ui Unifi Cloud Gateway Fiber Firmware <= 5.1.15
  • Ui Unas 2 Firmware <= 5.1.16
  • Ui Unas 4 Firmware <= 5.1.16
  • Ui Unas Pro Firmware <= 5.1.16
  • Ui Unas Pro 4 Firmware <= 5.1.16
  • Ui Unas Pro 8 Firmware <= 5.1.16
  • Ui Enterprise Firewall Core Firmware <= 5.1.18
  • Ui Unifi Dream Router 5g Max Firmware <= 5.1.15
Patched Versions
Not provided by NVD for this CVE.
🎁7-Day Free Trial — Try Pro or Team, no card required.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
📈EPSS Spike Alerts — Catch rising risk before it peaks.
🎯Custom EPSS/CVSS — Filter noise, focus on risk.
🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.
🐙GitHub Issues — Auto-tracked, no duplicates.
📬Weekly Digest — One clean summary, not inbox spam.
🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).
💬Webhooks — Slack & Teams integration.
🔀Smart Routing — Critical alerts to one channel, rest to another.
🚫Ad-Free — Uninterrupted experience.
🎁7-Day Free Trial — Try Pro or Team, no card required.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
📈EPSS Spike Alerts — Catch rising risk before it peaks.
🎯Custom EPSS/CVSS — Filter noise, focus on risk.
🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.
🐙GitHub Issues — Auto-tracked, no duplicates.
📬Weekly Digest — One clean summary, not inbox spam.
🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).
💬Webhooks — Slack & Teams integration.
🔀Smart Routing — Critical alerts to one channel, rest to another.
🚫Ad-Free — Uninterrupted experience.

External References