CVE-2026-54401: A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS…

PriorityP357high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.43%

36.7th percentile

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.

Affected

44 ranges· showing 25

Vendor	Product	Version range	Fixed in
ubiquiti_inc	cloud_gateways	< 5.1.19	5.1.19
ubiquiti_inc	cloud_keys	< 5.1.19	5.1.19
ubiquiti_inc	dream_machines	< 5.1.19	5.1.19
ubiquiti_inc	dream_routers	< 5.1.19	5.1.19
ubiquiti_inc	dream_wall	< 5.1.19	5.1.19
ubiquiti_inc	enterprise_firewall_core	< 5.1.19	5.1.19
ubiquiti_inc	enterprise_fortress_gateway	< 5.1.19	5.1.19
ubiquiti_inc	enterprise_video_recorders	< 5.1.19	5.1.19
ubiquiti_inc	express_7	< 5.1.19	5.1.19
ubiquiti_inc	network_attached_storage	< 5.1.19	5.1.19
ubiquiti_inc	network_video_recorders	< 5.1.19	5.1.19
ubiquiti_inc	unifi_os_server	< 5.1.19	5.1.19
ui	enterprise_firewall_core_firmware	<= 5.1.18	—
ui	enterprise_fortress_gateway_firmware	<= 5.1.15	—
ui	enterprise_network_video_recorder_core_firmware	<= 5.1.15	—
ui	enterprise_network_video_recorder_firmware	<= 5.1.15	—
ui	unas_2_firmware	<= 5.1.16	—
ui	unas_4_firmware	<= 5.1.16	—
ui	unas_pro_4_firmware	<= 5.1.16	—
ui	unas_pro_8_firmware	<= 5.1.16	—
ui	unas_pro_firmware	<= 5.1.16	—
ui	unifi_cloud_gateway_fiber_firmware	<= 5.1.15	—
ui	unifi_cloud_gateway_industrial_firmware	<= 5.1.15	—
ui	unifi_cloud_gateway_max_firmware	<= 5.1.15	—
ui	unifi_cloud_gateway_ultra_firmware	<= 5.1.15	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.