VDB

CVE-2026-54404

CVE-2026-54404 PUBLISHED CVSS 8.8 HIGH

Reported by hackerone · Published July 2, 2026

A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.

Risk Scores

CVSS 3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Ubiquiti IncUniFi OS Server0
Ubiquiti IncDream Machines0
Ubiquiti IncEnterprise Fortress Gateway0
Ubiquiti IncDream Wall0
Ubiquiti IncDream Routers0
Ubiquiti IncExpress 70
Ubiquiti IncCloud Keys0
Ubiquiti IncNetwork Video Recorders0
Ubiquiti IncEnterprise Video Recorders0
Ubiquiti IncCloud Gateways0
Ubiquiti IncNetwork Attached Storage0
Ubiquiti IncEnterprise Firewall Core0
Ubiquiti IncCloud Keys0, 0
Ubiquiti IncNetwork Video Recorders0, 0
Ubiquiti IncNetwork Attached Storage0, 0
Ubiquiti IncExpress 70, 0
Ubiquiti IncEnterprise Video Recorders0, 0
Ubiquiti IncDream Machines0, 0
Ubiquiti IncUniFi OS Server0, 0
Ubiquiti IncDream Wall0, 0

…and 4 more

Timeline

  • Jul 2, 2026 CVE Published
  • Jul 3, 2026 EPSS Score
  • Jul 3, 2026 CVE Updated
  • Jul 4, 2026 Coalition ESS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›