Summary
CVE-2026-55116 is a critical Improper Access Control vulnerability (CWE-284) affecting a wide range of devices running Ubiquiti UniFi OS, all versions prior to 5.1.19. A remote attacker with no prior authentication required can exploit this flaw under certain network configurations to make unauthorized changes to affected UniFi OS devices. Disclosed by Ubiquiti on July 2, 2026 via Security Advisory Bulletin 066 (SAB-066), the vulnerability carries a CVSS v3.1 base score of 9.0 (Critical) due to its potential for full confidentiality, integrity, and availability impact with a changed scope.
Technical details
- Root cause: Improper access control (CWE-284) within the UniFi OS server component fails to enforce authorization checks under certain network configurations, permitting unauthorized actors to reach protected functionality.
- Trigger conditions: Exploitation requires network access to the affected device and depends on specific network configurations being present; no credentials or user interaction are needed.
- Attack vector: Network-accessible (AV:N); the attack can be initiated remotely. The High Attack Complexity (AC:H) rating reflects the requirement for particular network conditions to be met before exploitation is possible.
- Impact: Successful exploitation allows an unauthenticated attacker to make arbitrary unauthorized changes to the UniFi OS device, resulting in full compromise of confidentiality (C:H), integrity (I:H), and availability (A:H) — including potential configuration manipulation, disruption of gateway and firewall functions, and lateral movement within connected networks. The Changed Scope (S:C) indicator means the impact can extend beyond the vulnerable component itself.
Affected software
All of the following Ubiquiti product lines are affected when running UniFi OS versions prior to 5.1.19:
- Dream Machines
- Enterprise Fortress Gateway
- Dream Wall
- Dream Routers
- Express 7
- Cloud Gateways
- Enterprise Firewall Core
Severity
- CVSS v3.1 Base Score: 9.0 (Critical)
- Vector String:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate action — patch now: Upgrade all affected devices to UniFi OS version 5.1.19 or later, as released by Ubiquiti. Updates can be applied through the UniFi OS console management interface.
- Network mitigation (if immediate patching is not possible): Restrict network access to UniFi OS management interfaces by placing affected devices behind a dedicated management VLAN or firewall rules that limit inbound access to trusted administrative hosts only. Reducing the attack surface by preventing arbitrary network paths to the device management plane limits the conditions under which this vulnerability can be exploited.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.