CVE-2026-55116

State: Published
Severity: 9.0 Critical
Published: Jul 2, 2026
Updated: Jul 2, 2026
Reserved: Jun 16, 2026

Description

A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	hackerone

Weaknesses

CWE-284 Improper Access Control - Generic

Affected Products

Product	Versions
Dream MachinesUbiquiti Inc	before 5.1.19Affected
Enterprise Fortress GatewayUbiquiti Inc	before 5.1.19Affected
Dream WallUbiquiti Inc	before 5.1.19Affected
Dream RoutersUbiquiti Inc	before 5.1.19Affected
Express 7Ubiquiti Inc	before 5.1.19Affected
Cloud GatewaysUbiquiti Inc	before 5.1.19Affected
Enterprise Firewall CoreUbiquiti Inc	before 5.1.19Affected

References

https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.