# CVE-2026-55112: Ubiquiti UniFi OS privilege escalation in UniFi Protect

Source: https://junglewise.ai/threats/cve-2026-55112-ubiquiti-unifi-os-privilege-escalation-in-unifi-protect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-55112 · Severity: high · CVSS 7.5 · Published 2026-07-02

A security vulnerability has been identified in Ubiquiti UniFi OS devices running the UniFi Protect application, which is used for video surveillance management. An authorized user with low-level access could exploit this flaw to gain higher-level administrative control over the device. This could allow an attacker to compromise the security of the surveillance system and the underlying hardware.

Technologies: [Ubiquiti Cloud Gateway](https://junglewise.ai/threats/technologies/cloud-gateway), [Ubiquiti Cloud Key](https://junglewise.ai/threats/technologies/cloud-key), [Ubiquiti Dream Machine](https://junglewise.ai/threats/technologies/dream-machine), [Ubiquiti Dream Router](https://junglewise.ai/threats/technologies/dream-router), [Ubiquiti Dream Wall](https://junglewise.ai/threats/technologies/dream-wall), [Ubiquiti Enterprise Video Recorder](https://junglewise.ai/threats/technologies/enterprise-video-recorder), [Ubiquiti Network Video Recorder](https://junglewise.ai/threats/technologies/network-video-recorder). Vendors: [Ubiquiti](https://junglewise.ai/threats/vendors/ubiquiti).

## Quick answers

**Is CVE-2026-55112 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55112 being exploited in the wild.

**How severe is CVE-2026-55112?** High severity, with a CVSS score of 7.5, published 2 July 2026.

**Which products and versions are affected?** Ubiquiti Cloud Gateway < 5.1.19; Ubiquiti Cloud Key < 5.1.19; Ubiquiti Dream Machine < 5.1.19; Ubiquiti Dream Router < 5.1.19; and 3 more.

**Is there a fix for CVE-2026-55112?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-55112 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55112?** Check whether you run Ubiquiti Cloud Gateway, Ubiquiti Cloud Key, Ubiquiti Dream Machine or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper access control vulnerability (CWE-284) exists in UniFi OS when running the UniFi Protect Application. A remote attacker with low-level authenticated access to the network can exploit this flaw under specific conditions to escalate their privileges to a higher level on the host device. The attack requires high complexity (AC:H) but no user interaction. The vulnerability affects multiple Ubiquiti hardware lines including Dream Machines, Dream Routers, and Network Video Recorders. The issue is resolved in UniFi Protect version 5.1.19 and later.

## Affected products

- Ubiquiti Inc Dream Machines < 5.1.19
- Ubiquiti Inc Dream Wall < 5.1.19
- Ubiquiti Inc Dream Routers < 5.1.19
- Ubiquiti Inc Cloud Keys < 5.1.19
- Ubiquiti Inc Network Video Recorders < 5.1.19
- Ubiquiti Inc Enterprise Video Recorders < 5.1.19
- Ubiquiti Inc Cloud Gateways < 5.1.19

## Timeline

- 2026-07-02: advisory
- 2026-07-02: disclosed

## References

- [https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc](https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc)

## Related threats

- [Ubiquiti UniFi OS improper access control in multiple gateways](https://junglewise.ai/threats/cve-2026-55116-ubiquiti-unifi-os-improper-access-control-in-multiple-gateways)
- [Ubiquiti UniFi OS CORS misconfiguration session hijacking](https://junglewise.ai/threats/cve-2026-55110-ubiquiti-unifi-os-cors-misconfiguration-session-hijacking)
- [Ubiquiti UniFi OS SQL injection privilege escalation](https://junglewise.ai/threats/cve-2026-54404-ubiquiti-unifi-os-sql-injection-privilege-escalation)
- [Ubiquiti UniFi OS authentication bypass via path traversal](https://junglewise.ai/threats/cve-2026-54403-ubiquiti-unifi-os-authentication-bypass-via-path-traversal)
- [Ubiquiti UniFi OS command injection via improper input validation](https://junglewise.ai/threats/cve-2026-54402-ubiquiti-unifi-os-command-injection-via-improper-input-validation)