CVE-2026-54401: Ubiquiti UniFi OS SSRF privilege escalation

CVE-2026-54401 · Severity: high · CVSS 7.7 · Published 2026-07-02

Ubiquiti UniFi OS devices, which manage networking and security hardware, are vulnerable to a security flaw that allows an authorized user with low-level access to gain higher administrative privileges. By exploiting this flaw, an attacker could potentially take control of the device or access sensitive configuration data. This affects various UniFi hardware including Dream Machines, Cloud Keys, and Video Recorders.

Technologies: Ubiquiti Cloud Gateway, Ubiquiti Cloud Key, Ubiquiti Dream Machine, Ubiquiti Dream Router, Ubiquiti Dream Wall, Ubiquiti Enterprise Firewall Core, Ubiquiti Enterprise Video Recorder, Ubiquiti Network Video Recorder, Ubiquiti UniFi OS. Vendors: Ubiquiti.

Quick answers

Is CVE-2026-54401 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54401 being exploited in the wild.
How severe is CVE-2026-54401?
High severity, with a CVSS score of 7.7, published 2 July 2026.
Which products and versions are affected?
Ubiquiti Cloud Gateway < 5.1.19; Ubiquiti Cloud Key < 5.1.19; Ubiquiti Dream Machine < 5.1.19; Ubiquiti Dream Router < 5.1.19; and 5 more.
Is there a fix for CVE-2026-54401?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-54401 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54401?
Check whether you run Ubiquiti Cloud Gateway, Ubiquiti Cloud Key, Ubiquiti Dream Machine or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists in Ubiquiti UniFi OS across multiple hardware platforms. An attacker with network connectivity and valid low-privileged credentials can trigger the vulnerability to make unauthorized requests from the server's perspective. This can be leveraged to bypass internal security controls and achieve privilege escalation within the UniFi OS environment. The vulnerability is addressed in UniFi OS version 5.1.19 and later.

Affected products

  • Ubiquiti Inc UniFi OS Server < 5.1.19
  • Ubiquiti Inc Dream Machines < 5.1.19
  • Ubiquiti Inc Enterprise Fortress Gateway < 5.1.19
  • Ubiquiti Inc Dream Wall < 5.1.19
  • Ubiquiti Inc Dream Routers < 5.1.19
  • Ubiquiti Inc Express 7 < 5.1.19
  • Ubiquiti Inc Cloud Keys < 5.1.19
  • Ubiquiti Inc Network Video Recorders < 5.1.19
  • Ubiquiti Inc Enterprise Video Recorders < 5.1.19
  • Ubiquiti Inc Cloud Gateways < 5.1.19
  • Ubiquiti Inc Network Attached Storage < 5.1.19
  • Ubiquiti Inc Enterprise Firewall Core < 5.1.19

Timeline

  • 2026-07-02: disclosed
  • 2026-07-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.