THREAT INTELLIGENCE REPORT: CVE-2026-55116

Executive Summary

CVE-2026-55116 is a critical Improper Access Control vulnerability affecting devices running UniFi OS. A malicious actor with network access, under specific network configurations, can exploit this flaw to make unauthorized changes to UniFi OS devices. With a CVSS score of 9.0 (Critical), this vulnerability poses significant risk to organizations deploying UniFi networking infrastructure, potentially allowing attackers to modify device configurations, disrupt network operations, or establish persistent unauthorized access. No patch is currently available from the vendor.

Technical Analysis

The vulnerability is classified as an Improper Access Control issue (CWE-284) affecting UniFi OS devices. The NVD description indicates that exploitation requires two conditions:

1. Network access — the attacker must be able to reach the affected device over the network
2. Specific network configurations — certain network topologies or settings must be in place for the attack to succeed

The vulnerability exists within the UniFi OS platform, which is the operating system layer used across Ubiquiti's UniFi product line. UniFi OS manages network controllers, access points, switches, security gateways, and other networking infrastructure.

While the NVD description does not specify the exact attack vector, Improper Access Control vulnerabilities in device management interfaces typically involve:

• Insufficient authorization checks on administrative API endpoints or management interfaces
• Missing authentication on certain configuration-change functions
• Bypass of role-based access control (RBAC) due to flawed session validation or token handling

The severity (CVSS 9.0) combined with the network accessibility suggests this is exploitable without requiring prior authentication in certain configurations. The phrase "under certain network configurations" implies that specific deployment scenarios (e.g., management interfaces exposed on untrusted networks, misconfigured VLANs, or devices reachable from broader network segments than intended) increase the attack surface.

The attack surface consists of the management interface and API endpoints exposed on UniFi OS devices. Given the nature of UniFi deployments—typically managing network infrastructure for SMBs and enterprises—successful exploitation could result in unauthorized configuration changes affecting the entire managed network infrastructure.

Exploitation Scenarios

Scenario 1: Internal Network Attack Against Exposed Management Interface

Step 1 — Reconnaissance: The attacker performs network scanning within a compromised or accessible network segment to identify UniFi OS devices. Tools like Nmap with service detection can identify the UniFi controller's management interface (typically TCP port 8443 for HTTPS management). Shodan queries can also surface internet-exposed UniFi devices misconfigured with management interfaces on public-facing networks.

Step 2 — Target Identification: The attacker enumerates accessible UniFi OS endpoints, identifying the management web interface and API. They may probe for version information to confirm UniFi OS presence and determine if network configurations make the target vulnerable.

Step 3 — Exploitation Trigger: The attacker sends crafted HTTP requests to the management API endpoints, attempting to invoke configuration-change operations without proper authorization. This could involve:

• Directly calling API endpoints that modify device settings without a valid session token
• Manipulating HTTP headers or parameters to bypass access control checks
• Exploiting session handling flaws that permit unauthorized state-change requests

Step 4 — Payload/Execution: Once the access control bypass succeeds, the attacker issues configuration change commands. This could include:

• Altering network settings (DHCP configurations, VLAN assignments, firewall rules)
• Changing administrative credentials to lock out legitimate administrators
• Modifying SSID/security parameters on associated access points

Step 5 — Post-Exploitation: With unauthorized configuration control, the attacker can:

• Establish persistence by creating backdoor accounts
• Disrupt network services, causing denial-of-service conditions
• Exfiltrate configuration data containing network topology information
• Relay attacks to compromise additional network devices

Scenario 2: Lateral Movement from Compromised Endpoint

Step 1 — Initial Compromise: An attacker gains foothold on an endpoint within the corporate network through phishing or another vulnerability.

Step 2 — Network Reconnaissance: From the compromised endpoint, the attacker conducts network discovery to locate UniFi OS devices on the internal network. They may use ARP scanning, port scanning, or examine DHCP lease information for Ubiquiti device MAC prefixes.

Step 3 — Direct Exploitation: The attacker leverages the access control bypass from the internal network position, sending unauthenticated configuration-change requests directly to the identified UniFi OS management service.

Step 4 — Infrastructure Compromise: Successful exploitation grants the attacker control over the UniFi OS device, potentially compromising the entire network management plane. This enables further attacks on managed infrastructure.

Impact Assessment

Business Impact

• Confidentiality Impact: High — Configuration data, network topology information, and potentially credentials stored on UniFi devices could be exposed
• Integrity Impact: High — Unauthorized configuration changes could disrupt legitimate network operations, alter security controls, or inject malicious settings
• Availability Impact: High — Attackers could render devices non-functional, disable network segments, or lock out legitimate administrators

Affected Systems

All devices running UniFi OS are potentially affected, including:

• UniFi Network Controllers (Cloud Keys, Dream Machines)
• UniFi Security Gateways
• UniFi Access Points (running UniFi OS variants)
• UniFi Switches

Blast Radius

Given that UniFi devices often serve as the central management point for organizational network infrastructure, the blast radius extends beyond the individual device to the entire managed network. A single compromised UniFi OS device can be leveraged to:

• Disable network segmentation controls
• Intercept or redirect network traffic
• Disrupt operations across multiple sites managed by a central controller
• Serve as a pivot point for deeper network penetration

The CVSS score of 9.0 with unknown vector components suggests the vulnerability is remotely exploitable with low attack complexity and no privileges required, consistent with the critical severity rating. The EPSS score of 0.00414 (34.1% percentile) indicates that while exploitation is not currently widespread, the vulnerability is being tracked and could see increased exploitation activity as details become public.

Detection Guidance

Sigma Rule

title: Potential CVE-2026-55116 UniFi OS Unauthorized Configuration Change Attempt
id: 67f91a3e-9c2b-4d8e-8f44-2eb38e82b7a3
status: experimental
description: Detects suspicious unauthenticated requests to UniFi OS management endpoints attempting configuration changes, potentially indicating CVE-2026-55116 exploitation
author: Valters IT Security Team
date: 2026/01/15
logsource:
  category: webserver
  product: unifi
detection:
  selection_unauth:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
      - 'DELETE'
    cs-uri-query|contains:
      - '/api/sites/'
      - '/api/sys/config/'
      - '/api/stat/sysinfo'
      - '/v2/api/site'
  selection_no_session:
    cs-uri-query|contains:
      - 'api'
    cs-headers|contains:
      - 'Cookie:'
    cs-headers|re: '^(?!.*(X-CSRF|Authorization|SessionId)).*'
  filter_known_ips:
    c-ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_unauth and selection_no_session and not filter_known_ips
  timeframe: 15m
level: high
tags:
  - attack.t1190
  - attack.initial-access
  - cve.2026-55116
  - cwe.284
falsepositives:
  - Legitimate management tools making unauthenticated status calls
  - Misconfigured monitoring systems

YARA Rule

rule CVE_2026_55116_UniFi_OS_Access_Control_Bypass
{
    meta:
        author = "Valters IT Security Team"
        date = "2026-01-15"
        description = "Detects suspicious patterns in web requests targeting UniFi OS management interfaces"
        reference = "CVE-2026-55116"
        severity = "high"
    
    strings:
        $api_path = "/api/site/" ascii
        $api_config = "/api/sys/config" ascii
        $api_update = "/api/update" ascii
        $unifi_sess = "/api/auth/login" ascii
        $csrf_missing = "X-CSRF-Token" ascii
        $change_method = "POST" ascii
        $change_method2 = "PUT" ascii
        $change_method3 = "DELETE" ascii
    
    condition:
        (uint16(0) == 0x0d0a or filesize < 10KB) and
        (($api_path or $api_config or $api_update) and
         ($change_method or $change_method2 or $change_method3) and
         not $csrf_missing) or
        ($unifi_sess and $change_method and filesize < 5KB)
}

Suricata IDS Rule

alert http any any -> any 8443 (msg:"CVE-2026-55116 Attempt - Unauthorized UniFi OS Configuration Change"; flow:to_server,established; content:"POST"; http_method; content:"/api/site/"; http_uri; nocase; content:"/api/sys/config"; http_uri; nocase; content:"!Cookie"; http_cookie; distance:0; flowbits:set,unifi_admin_attempt; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:20265511; rev:1; priority:1; reference:cve,2026-55116;)

alert http any any -> any 8443 (msg:"CVE-2026-55116 Attempt - Unauthenticated UniFi API Access"; flow:to_server,established; content:"PUT"; http_method; content:"/api/site/"; http_uri; nocase; content:"Content-Type: application/json"; http_header; content:"!Authorization"; http_header; distance:0; flowbits:set,unifi_unauth_access; classtype:attempted-admin; sid:20265512; rev:1; priority:1; reference:cve,2026-55116;)

alert http any any -> any 8443 (msg:"CVE-2026-55116 Possible Exploitation - Multiple Unauthorized Config Attempts"; flow:to_server,established; threshold:type both, track by_src, count 10, seconds 120; http_uri; content:"/api/"; nocase; content:"!X-CSRF-Token"; http_header; classtype:attempted-admin; sid:20265513; rev:1; priority:1; reference:cve,2026-55116;)

Elastic Detection

// EQL query for Elastic SIEM
sequence by source.ip with maxspan=5m
  [network where destination.port == 8443 and network.protocol == "http" and
   http.request.method == "GET" and
   http.request.uri contains "/api/stat/"]
  [network where destination.port == 8443 and network.protocol == "http" and
   http.request.method in ("POST", "PUT", "DELETE") and
   http.request.uri contains "/api/site/" and
   not http.request.headers.cookie : "*"
  ]

Splunk SPL Query

index=proxy OR index=firewall sourcetype="unifi:os:audit"
| where dest_port=8443
| eval is_unauth=if(match(url,"/api/"),1,0)
| eval is_change=if(match(method,"POST|PUT|DELETE"),1,0)
| eval is_config=if(match(url,"/api/site/|/api/sys/config|/api/update"),1,0)
| where is_unauth=1 AND is_change=1 AND is_config=1
| fillnull value="none" cookie
| where cookie="none"
| table _time, src_ip, dest_ip, url, method, user_agent, dest_port
| stats count by src_ip, dest_ip
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="unifi_cve_2026_55116,">
  <rule id="202611" level="14">
    <if_sid>web, 31100</if_sid>
    <match>/api/site/|/api/sys/config|/api/update</match>
    <regex>(\bPOST\b|\bPUT\b|\bDELETE\b)</regex>
    <description>CVE-2026-55116: Potential unauthorized UniFi OS configuration change attempt</description>
    <group>access_control,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-55116</info>
  </rule>

  <rule id="202612" level="14">
    <if_sid>web</if_sid>
    <match>/api/</match>
    <regex>\b(?i)(?!.*cookie).*(POST|PUT|DELETE)\b</regex>
    <description>CVE-2026-55116: Unauthenticated request to UniFi OS API detected</description>
    <group>access_control,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-55116</info>
  </rule>

  <rule id="202613" level="10" frequency="10" timeframe="120">
    <if_matched_sid>202611</if_matched_sid>
    <description>CVE-2026-55116: Multiple unauthorized UniFi OS access attempts from same source</description>
    <group>access_control,</group>
    <info type="cve">CVE-2026-55116</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source

1. Immediate Mitigations

Since no vendor patch is currently available, organizations should implement the following immediate measures:

• Restrict network access to UniFi OS management interfaces. Ensure management ports (8443, 8080) are not exposed to untrusted networks, including the internet. Use firewall rules to limit access to trusted administrative IP ranges only
• Review network segmentation — verify that UniFi management traffic is isolated from user-facing network segments. Ensure VLANs and subnets hosting UniFi OS devices are not directly reachable from lower-trust zones
• Monitor management interface logs for anomalous configuration-change activity, especially requests lacking proper session tokens or from unexpected source IPs
• Disable remote management if not actively required, or restrict it to VPN connections only
• Implement network-level intrusion detection rules (as provided above) to alert on suspicious UniFi OS API activity
• Audit current configurations for any unauthorized changes that may indicate prior exploitation

2. Patch/Upgrade Steps

• Monitor Ubiquiti's official security advisories and UniFi OS release notes for a patched version
• When a patch becomes available, prioritize deployment to Internet-facing UniFi devices first, followed by internal management infrastructure
• Test the patch in a staging environment before production deployment
• Verify patch integrity via official Ubiquiti download channels
• Note: While the NVD description does not specify a fixed version, the "Improper Access Control" class of vulnerability typically receives a firmware/software update. Maintain regular update cadence for all UniFi OS devices

3. Long-Term Hardening

• Implement strong authentication — enforce multi-factor authentication (MFA) for all UniFi OS administrative accounts
• Adopt the principle of least privilege — limit administrative access to only essential personnel
• Enable comprehensive logging — ensure UniFi OS audit logs are exported to a centralized SIEM for continuous monitoring
• Implement network monitoring — deploy network detection and response (NDR) solutions to monitor traffic patterns to and from UniFi infrastructure
• Establish change control procedures — require documented change requests for all configuration modifications to UniFi devices
• Maintain asset inventory — keep an up-to-date inventory of all UniFi OS devices, their versions, and network locations
• Regular security assessments — conduct periodic penetration testing of UniFi management infrastructure to identify misconfigurations that could trigger the vulnerable conditions described in this CVE

References

1. NVD Entry for CVE-2026-55116 — https://nvd.nist.gov/vuln/detail/CVE-2026-55116 (Official vulnerability description and scoring information)

2. Ubiquiti UniFi OS Documentation — https://ui.com/download/unifi (Official vendor documentation for UniFi OS devices; monitor for security advisories)

3. CVE Details — CVE-2026-55116 — https://www.cvedetails.com/cve/CVE-2026-55116/ (Third-party vulnerability tracking)

4. CWE-284: Improper Access Control — https://cwe.mitre.org/data/definitions/284.html (Weakness documentation for the vulnerability class)

5. MITRE ATT&CK — T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/ (Technique mapping for this vulnerability)

Note on Threat Actor Activity: As of this report, there are no known active exploitation campaigns specifically leveraging CVE-2026-55116. The CISA KEV catalog does not currently list this CVE. However, given the critical severity (CVSS 9.0) and the widespread deployment of UniFi products in SMB and enterprise environments, organizations should treat this as a high-priority threat and implement the recommended mitigations proactively. Regular monitoring of Ubiquiti's security advisories is strongly advised, as patches may become available after the publication of this report.