CVE-2026-55110: Ubiquiti UniFi OS CORS misconfiguration session hijacking

CVE-2026-55110 · Severity: high · CVSS 7.5 · Published 2026-07-02

Ubiquiti UniFi OS, the management software for UniFi networking and security hardware, is affected by a security flaw that could allow an attacker to hijack a user's session. If an administrator is logged into their UniFi console and visits a malicious website, the attacker can perform unauthorized actions on the UniFi device as if they were that administrator. This could lead to unauthorized configuration changes, data access, or loss of control over the managed network infrastructure.

Technologies: Ubiquiti Cloud Gateway, Ubiquiti Cloud Key, Ubiquiti Dream Machine, Ubiquiti Dream Router, Ubiquiti Dream Wall, Ubiquiti Enterprise Firewall Core, Ubiquiti Enterprise Video Recorder, Ubiquiti Network Video Recorder, Ubiquiti UniFi OS. Vendors: Ubiquiti.

Quick answers

Is CVE-2026-55110 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55110 being exploited in the wild.
How severe is CVE-2026-55110?
High severity, with a CVSS score of 7.5, published 2 July 2026.
Which products and versions are affected?
Ubiquiti Cloud Gateway < 5.1.19; Ubiquiti Cloud Key < 5.1.19; Ubiquiti Dream Machine < 5.1.19; Ubiquiti Dream Router < 5.1.19; and 5 more.
Is there a fix for CVE-2026-55110?
A patch was published on 2026-07-02: Fix released in UniFi OS 5.1.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55110 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55110?
Check whether you run Ubiquiti Cloud Gateway, Ubiquiti Cloud Key, Ubiquiti Dream Machine or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Origin Resource Sharing (CORS) misconfiguration (CWE-942) exists in UniFi OS versions prior to 5.1.19. The vulnerability stems from a permissive cross-domain policy that allows untrusted domains to interact with the UniFi OS API. An attacker can exploit this by luring an authenticated administrator to a malicious webpage, which then executes cross-origin requests to the UniFi OS instance using the victim's active session cookies. Successful exploitation allows the attacker to perform any action the authenticated user is authorized to do, potentially leading to full system compromise. The issue is resolved in UniFi OS version 5.1.19 and later.

Affected products

  • Ubiquiti Inc UniFi OS Server < 5.1.19
  • Ubiquiti Inc Dream Machines < 5.1.19
  • Ubiquiti Inc Enterprise Fortress Gateway < 5.1.19
  • Ubiquiti Inc Dream Wall < 5.1.19
  • Ubiquiti Inc Dream Routers < 5.1.19
  • Ubiquiti Inc Express 7 < 5.1.19
  • Ubiquiti Inc Cloud Keys < 5.1.19
  • Ubiquiti Inc Network Video Recorders < 5.1.19
  • Ubiquiti Inc Enterprise Video Recorders < 5.1.19
  • Ubiquiti Inc Cloud Gateways < 5.1.19
  • Ubiquiti Inc Network Attached Storage < 5.1.19
  • Ubiquiti Inc Enterprise Firewall Core < 5.1.19

Timeline

  • 2026-07-02: advisory: Initial advisory published by Ubiquiti and NVD
  • 2026-07-02: patched: Fix released in UniFi OS 5.1.19

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.