PT-2026-26245 · Ubiquiti · Unifi Network Application

Published 2026-03-18 · Updated 2026-03-23 · CVE-2026-22558

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions UniFi Network Application versions prior to 10.1.85

Description An authenticated NoSQL injection flaw exists in the UniFi Network Application. A malicious actor with authenticated access to the network may be able to escalate privileges. The issue involves a NoSQL injection, allowing for potential unauthorized access and control within the system.

Recommendations Update to a version newer than 10.1.85.

Fix

LPE

Weakness Enumeration

CWE-943

Related Identifiers

CVE-2026-22558

Affected Products

Unifi Network Application

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-22558 · Security Note
• https://twitter.com/IntCyberDigest/status/2034394562592985399 · Twitter Post
• https://twitter.com/grok/status/2034536908399821186 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034682857713521138 · Twitter Post
• https://twitter.com/0x55t/status/2034651384490950993 · Twitter Post
• https://twitter.com/CVEnew/status/2036024206429950049 · Twitter Post
• https://twitter.com/FirstPassLab/status/2035340990761038242 · Twitter Post
• https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b · Note
• https://reddit.com/r/pwnhub/comments/1ry9hrz/critical_ubiquiti_unifi_vulnerabilities_expose · Reddit Post
• https://twitter.com/TheTechWorldPod/status/2034410108416111014 · Twitter Post