CVE-2026-54400

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ui:unifi_access:*:*:*:*:*:*:*:*

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Un actor malicioso con acceso a la red y privilegios elevados podría explotar una vulnerabilidad de control de acceso inadecuado encontrada en la aplicación UniFi Access para escalar privilegios en el dispositivo anfitrión.

Information

Published : 2026-07-02 15:17

Updated : 2026-10-25 21:10

NVD link : CVE-2026-54400

Mitre link : CVE-2026-54400

CVE.ORG link : CVE-2026-54400

JSON object : View

Products Affected

ui

unifi_access

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-54400", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54400", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-02T16:10:53.382801Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "Ubiquiti Inc", "product": "UniFi Access Application", "versions": [{"status": "affected", "version": "0", "lessThan": "4.2.29", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-02T15:17:03.623", "references": [{"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device."}, {"lang": "es", "value": "Un actor malicioso con acceso a la red y privilegios elevados podr\u00eda explotar una vulnerabilidad de control de acceso inadecuado encontrada en la aplicaci\u00f3n UniFi Access para escalar privilegios en el dispositivo anfitri\u00f3n."}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ui:unifi_access:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CED8C93F-E70F-419F-ADA4-972BAFAF52AD", "versionEndExcluding": "4.2.29"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}