CVE-2026-55114

Executive Summary

CVE-2026-55114 is an Improper Access Control vulnerability in the UniFi Network Application, a network management platform produced by Ubiquiti Inc. and coordinated through HackerOne's disclosure program. A malicious actor with existing network access and low-privileged credentials can exploit this flaw to escalate privileges within the UniFi Network Application, potentially gaining administrative control over the network management plane. This is a high-severity vulnerability (CVSS 8.8) with no known patch, no public exploit code, and no confirmation of exploitation in the wild, though the low EPSS score (0.00260) suggests limited current attacker interest.

The affected component is the UniFi Network Application used by enterprise and SMB organizations to centrally manage Ubiquiti access points, switches, gateways, and other network infrastructure. Because the application holds administrative credentials and configuration data for an organization's entire network fabric, successful exploitation would allow an attacker to pivot from a low-privileged position to full control of network infrastructure.

Technical Analysis

The NVD description identifies this as an Improper Access Control vulnerability (CWE-284 class per the advisory context provided by HackerOne, though the exact CWE mapping is UNKNOWN from the NVD entry). The vulnerability resides within the UniFi Network Application's authorization mechanisms, where the application fails to enforce proper access control checks on certain operations or resources.

Vulnerability Mechanism:

The flaw allows a user authenticated with low privileges (e.g., a standard operator-level account or a network-restricted local user) to perform actions or access resources that should require administrator privileges. The root cause is an incomplete or bypassable authorization check in the application's backend API or management interface logic. Specifically, the application's privilege enforcement appears to rely on client-supplied context or insufficient server-side authorization validation for certain administrative functions.

Attack Surface:

• Authentication Requirement: The attacker must already have network access to the UniFi Network Application (typically via HTTPS on port 8443 or port 443 in current deployments) and possess low-privileged credentials.
• Privilege Boundary: The escalation is contained within the UniFi Network Application itself — it does not directly grant host OS access, but gains application-level administrative rights.
• Attack Vector: Network-based. The NVD description does not specify the exact vector (AV:N vs. AV:A), but the CVSS score of 8.8 typically correlates with a network vector and low attack complexity.

What Is Not Known:

• The specific affected version range is not disclosed (Affected Versions: []).
• The exact API endpoint, function name, or code path is not disclosed in the NVD description.
• The CWE identifier is UNKNOWN from the NVD record, though the description's use of "Improper Access Control" aligns with the CWE-284 class.
• No patch has been identified by any tracked source, and the patch confidence is 0/4.

The vulnerability class itself — Improper Access Control — encompasses scenarios where the application does not enforce that a request is made by an authorized principal for a protected resource. In the UniFi controller context, this commonly manifests as missing role-based authorization checks on API endpoints that manage site settings, user accounts, device adoption, or configuration exports. However, the exact mechanism remains undisclosed, and analysts should not assume specific endpoint details without further information.

Exploitation Scenarios

While no public PoC exists for this vulnerability, the exploitation path for an Improper Access Control flaw in a management application like UniFi Network Application follows a well-defined pattern. The following scenario is based on the vulnerability class and typical UniFi Network Application architecture:

Step 1: Reconnaissance and Target Identification

The attacker first identifies UniFi Network Application instances exposed to their network. For an on-premises deployment, this is typically done by scanning for open port 8443 (HTTPS management interface) or port 8080 (HTTP redirect for controller). The attacker may use tools like Nmap or masscan with service detection to confirm UniFi controller signatures — the login page and API responses include distinctive server headers and app identifiers. The attacker identifies valid low-privileged credentials through previous phishing, credential stuffing, or legitimate access (e.g., a disgruntled employee with a "viewer" or "operator" role).

Step 2: Authentication and Privilege Context Mapping

The attacker authenticates to the UniFi Network Application using the low-privileged account via the web UI or API (POST /api/login). After obtaining a session cookie, the attacker enumerates their effective permissions by querying the application's API endpoints. In low-privileged access, standard API calls to administrative functions (e.g., user management, system settings, firmware updates) return HTTP 403 Forbidden responses. The attacker records these denied endpoints to map the authorization boundary.

Step 3: Triggering the Access Control Bypass

The attacker crafts requests that exploit the missing authorization check. Typical techniques for this vulnerability class include:

• Parameter Manipulation: Adding administrative context parameters (e.g., isAdmin=true, role=admin) to API requests that the application fails to validate server-side.
• HTTP Method Override: Using X-HTTP-Method-Override headers to send a PATCH or PUT request to an endpoint that only validates GET requests, bypassing incomplete role checks.
• Direct Object Reference: Modifying request body payloads to include privileged action flags (e.g., cmd=system-update or settings-change with a crafted JSON body) that the server executes without revalidating the user's role.

In the UniFi context, the attacker might send a crafted POST request to the site management API (/api/s/<site>/cmd/sitemgr) — though the NVD description does not confirm this specific endpoint — attempting to add a new administrator account or modify their own role assignment. The attack succeeds because the server-side handler performs the operation without checking whether the calling session has the admin or superadmin role.

Step 4: Payload Execution and Privilege Escalation

Once the attacker finds a functional bypass, they create a new administrative account or elevate their existing account's role. They now have full administrative control over network configuration. If the UniFi Network Application is deployed on a Linux host, the attacker can leverage the application's administrative functions (e.g., device adoption, firmware upgrade) to push malicious configurations to managed access points and switches, or potentially escape to the host OS if the application exposes a shell/CLI function to admins.

Step 5: Post-Exploitation Impact

With administrative access, the attacker can:

• Rogue device adoption: Adopt malicious access points into the network.
• Configuration exfiltration: Export site configurations containing VLANs, firewall rules, and credentials.
• Persistent access: Create additional admin accounts, modify RADIUS server settings, and establish VPN backdoors through UniFi gateways.
• Lateral movement: Use the controller's SSH credentials for managed devices to access the broader network.

This attack chain is hypothesis-based but aligns with the described CWE-284 class and the UniFi Network Application's known attack surface.

Impact Assessment

Business Impact:

• Confidentiality: Complete compromise of network configuration data, including SSIDs, WPA keys, RADIUS secrets, and potentially VPN credentials stored in the controller.
• Integrity: Administrative control enables modification of firewall rules, VLAN assignments, port configurations, and device firmware — an attacker can sever network segments, inject rogue devices, or alter traffic routing.
• Availability: A malicious admin can disable network services, factory-reset devices, deploy broken configurations, or brick managed hardware.
• Compliance: Organizations subject to PCI-DSS, HIPAA, or SOC2 face reporting obligations if network infrastructure compromise occurs.

Affected Systems:

The UniFi Network Application is used in a wide range of environments, including enterprises, managed service providers (MSPs), hospitality, education, and retail deployments. The "hackerone / Unknown" vendor attribution in the NVD data, combined with the UniFi Network Application reference, points to Ubiquiti's product ecosystem. Both self-hosted (on-premises) and UniFi Cloud Key deployments are at risk if the application is accessible on the network.

Blast Radius:

• CVSS Context: The 8.8 score (High severity) reflects low attack complexity, low privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. The exact vector string is UNKNOWN from the NVD data.
• Network-Wide: Because the controller manages all UniFi devices, compromise of the application equates to compromise of the entire managed network fabric.
• Supply Chain: MSPs running multi-tenant UniFi controllers face cross-customer blast radius if one tenant's credentials are compromised.

Exploitation Probability: EPSS score of 0.00260 (17.7th percentile) indicates a low probability of exploitation in the wild relative to other known CVEs. This is consistent with the lack of public PoC and the modest current attacker attention. However, the high severity warrants proactive mitigation regardless of current threat levels.

Detection Guidance

Sigma Rule

title: UniFi Network Application - Privilege Escalation Attempt
id: 4f8b9d2e-3c5a-4f6b-9a1e-7d2c8b5f3a4e
status: experimental
description: Detects potential privilege escalation attempts against UniFi Network Application via abnormal API request patterns
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55114
author: Valtersit Threat Intelligence
date: 2026/05/14
logsource:
    category: application
    product: unifi
detection:
    selection_auth:
        cs_method: 'POST'
        cs_uri_stem|startswith: '/api/'
    selection_sensitive_endpoints:
        cs_uri_stem|contains:
            - '/cmd/sitemgr'
            - '/rest/user'
            - '/set/setting'
            - '/cmd/system'
    selection_low_priv:
        cs_username|contains: 'operator'
    filter_known_admin:
        cs_username|contains: 'admin'
    condition: selection_auth and selection_sensitive_endpoints and selection_low_priv and not filter_known_admin
level: high
falsepositives:
    - Legitimate admin tasks performed via API integration accounts with misleading usernames
tags:
    - attack.t1068
    - cve.2026.55114
    - cwe.284

YARA Rule

rule UniFi_PrivEsc_Exploit_Attempt
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects exploit attempt patterns for CVE-2026-55114 in HTTP logs/captured traffic"
        date = "2026-05-14"
        cve = "CVE-2026-55114"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55114"

    strings:
        $s1 = "cmd=sitemgr" ascii wide nocase
        $s2 = "role=admin" ascii wide nocase
        $s3 = "isAdmin=true" ascii wide nocase
        $s4 = "voucher" ascii wide nocase
        $s5 = "set/setting" ascii wide nocase
        $s6 = "superadmin" ascii wide nocase
        $s7 = "X-HTTP-Method-Override" ascii wide nocase
        $s8 = "/rest/user" ascii wide nocase
        $a1 = "operator" ascii wide nocase

    condition:
        any of ($s*) and $a1 and filesize < 10MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT UniFi Network Application Privilege Escalation Attempt (CVE-2026-55114)"; flow:established,to_server; content:"POST"; http_method; content:"/api/"; http_uri; content:"cmd=sitemgr"; http_uri; content:"role=admin"; http_uri; classtype:attempted-admin; sid:202655114; rev:1; reference:cve,2026-55114; priority:1;)

Elastic Detection

rule UniFiPrivEsc {
    when (method: "POST") and (url.path: "/api/*") and (
        (url.path contains "cmd/sitemgr") or
        (url.path contains "rest/user") or
        (url.path contains "set/setting")
    )
    and exists (user.name)
    and not (user.name in ["admin", "superadmin"])
    add_tags ["CVE-2026-55114", "privilege-escalation", "unifi"]
}

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path LIKE "/api/%" 
  AND (uri_path LIKE "%sitemgr%" OR uri_path LIKE "%rest/user%" OR uri_path LIKE "%set/setting%")
  AND NOT (user="admin" OR user="superadmin")
| stats count by src_ip, user, uri_path, status, _time
| table _time, src_ip, user, uri_path, status, count
| sort - count

Wazuh OSSEC Rule

<group name="unifi,privilege_escalation,">
  <rule id="100551" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/api/.*(?:cmd/sitemgr|rest/user|set/setting).*</field>
    <field name="http_method">POST</field>
    <field name="user" type="pcre2">^(?!admin|superadmin).*</field>
    <description>UniFi Network Application: Potential privilege escalation attempt (CVE-2026-55114)</description>
    <mitre><id>T1068</id></mitre>
    <group>unifi,privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, version fix, or commit has been identified at the time of writing. The NVD description does not reference a patched version.

1) Immediate Mitigations (until a patch is available):

• Network Segmentation: Place the UniFi Network Application on a dedicated management VLAN with strict firewall rules. Restrict access to only trusted administrative IP ranges. Do not expose the controller directly to the internet.
• Multi-Factor Authentication (MFA): Enforce MFA for all UniFi Network Application accounts to reduce the likelihood of low-privileged credential compromise.
• Minimize Low-Privilege Accounts: Audit all accounts in the controller and remove or suspend operator/viewer accounts that do not have an operational requirement. Reduce the attack surface of low-privileged access.
• Access Control Lists: Use UniFi's built-in role-based access control to restrict API access. If the application supports IP whitelisting for API access, enforce it.
• Monitoring: Implement the detection rules listed above to alert on suspicious API request patterns. Monitor for new admin account creation and role changes.

2) Patch/Upgrade Steps:

• Monitor the Ubiquiti official release notes (community.ui.com and ubiquiti.com) for security advisory announcements related to the UniFi Network Application.
• Subscribe to the Ubiquiti security notification list or monitor the NVD feed for updates to this CVE record.
• When a patched version is released, upgrade all UniFi Network Application instances (self-hosted on Linux/Windows, Docker containers, and UniFi Cloud Key devices) to the latest stable release.
• For cloud-hosted UniFi (unifi.ui.com), Ubiquiti typically applies patches automatically; verify the current version after patch announcements.
• Follow Ubiquiti's official upgrade documentation, including recommended backup procedures before upgrading.

3) Long-Term Hardening:

• Least Privilege Architecture: Design roles so that no user has standing administrative access. Use break-glass admin accounts with MFA and just-in-time elevation, if supported.
• Regular Security Audits: Perform periodic reviews of UniFi controller user accounts, role assignments, and audit logs for anomalies.
• Vulnerability Management: Integrate the UniFi Network Application into your enterprise vulnerability scanning program. Track CVE-2026-55114 status until a patch is confirmed.
• Network Device Hygiene: Apply firmware updates to UniFi access points, switches, and gateways as part of routine maintenance. Compromised controllers can push malicious firmware to devices.
• Alternative Access Controls: If the deployment allows, restrict administrative operations to an out-of-band management network, separate from user data traffic.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-55114 — Official National Vulnerability Database record; primary source for this intelligence report. Contains the official description and scoring.

2. HackerOne Disclosure Program (vendor coordination): https://hackerone.com/ubiquiti — The CNA attribution references hackerone as the coordinating disclosure platform. The program page provides contact methods for vulnerability disclosure; future vendor advisories will likely appear here or on Ubiquiti's security portal.

3. Ubiquiti Security Advisories and Release Notes: https://community.ui.com/releases — Official Ubiquiti release notes and security advisories. Monitor this page for the eventual patch announcement and affected version details.

4. MITRE ATT&CK Technique Reference — T1068 (Exploitation for Privilege Escalation): https://attack.mitre.org/techniques/T1068/ — Reference framework for the privilege escalation tactic category this vulnerability aligns with.

5. Ubiquiti UniFi Network Application Documentation: https://help.ui.com/hc/en-us/articles/360015252354-UniFi-Network-Application-Overview — Official architecture documentation to understand the product's deployment models and attack surface.

Known Threat Actor Activity:

As of this report, there is no evidence of exploitation in the wild. The CISA KEV (Known Exploited Vulnerabilities) catalog does not list CVE-2026-55114, and no public exploit code, PoC, or Nuclei template exists. The low EPSS score (0.00260) and the lack of public research indicate that this vulnerability has not yet attracted significant attacker attention. However, given the high CVSS score and the criticality of network management infrastructure, organizations should not delay implementing mitigations in the expectation that exploitation probability will remain low.