CVE-2026-54403
published 2026-07-02CVE-2026-54403: A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of…
PriorityP263high8.6CVSS 3.1
AVNACLPRNUINSCCHINAN
EPSS
0.77%
54.3th percentile
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ubiquiti_inc | cloud_gateways | < 5.1.19 | 5.1.19 |
| ubiquiti_inc | cloud_keys | < 5.1.19 | 5.1.19 |
| ubiquiti_inc | dream_machines | < 5.1.19 | 5.1.19 |
| ubiquiti_inc | dream_routers | < 5.1.19 | 5.1.19 |
| ubiquiti_inc | dream_wall | < 5.1.19 | 5.1.19 |
| ubiquiti_inc | enterprise_firewall_core | < 5.1.19 | 5.1.19 |
| ubiquiti_inc | enterprise_fortress_gateway | < 5.1.19 | 5.1.19 |
| ubiquiti_inc | enterprise_video_recorders | < 5.1.19 | 5.1.19 |
| ubiquiti_inc | express_7 | < 5.1.19 | 5.1.19 |
| ubiquiti_inc | network_attached_storage | < 5.1.19 | 5.1.19 |
| ubiquiti_inc | network_video_recorders | < 5.1.19 | 5.1.19 |
| ubiquiti_inc | unifi_os_server | < 5.1.19 | 5.1.19 |
| ui | enterprise_firewall_core_firmware | <= 5.1.18 | — |
| ui | enterprise_fortress_gateway_firmware | <= 5.1.15 | — |
| ui | enterprise_network_video_recorder_core_firmware | <= 5.1.15 | — |
| ui | enterprise_network_video_recorder_firmware | <= 5.1.15 | — |
| ui | unas_2_firmware | <= 5.1.16 | — |
| ui | unas_4_firmware | <= 5.1.16 | — |
| ui | unas_pro_4_firmware | <= 5.1.16 | — |
| ui | unas_pro_8_firmware | <= 5.1.16 | — |
| ui | unas_pro_firmware | <= 5.1.16 | — |
| ui | unifi_cloud_gateway_fiber_firmware | <= 5.1.15 | — |
| ui | unifi_cloud_gateway_industrial_firmware | <= 5.1.15 | — |
| ui | unifi_cloud_gateway_max_firmware | <= 5.1.15 | — |
| ui | unifi_cloud_gateway_ultra_firmware | <= 5.1.15 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Ubiquiti UniFi OS Server up to 5.1.18 path traversal
vuldb·2026-07-02·CVSS 8.6
CVE-2026-54403 [HIGH] Ubiquiti UniFi OS Server up to 5.1.18 path traversal
A vulnerability classified as critical has been found in Ubiquiti UniFi OS Server, Dream Machines, Enterprise Fortress Gateway, Dream Wall, Dream Routers, Express 7, Cloud Keys, Network Video Recorders, Enterprise Video Recorders, Cloud Gateways, Network Attached Storage and Enterprise Firewall Core up to 5.1.18. Impacted is an unknown function. The manipulation leads to path traversal.
This vulnerability is documented as CVE-2026-54403. The attack can be initiated remotely. There is not any exploit available.
It is recommended to upgrade the affected component.
GHSA
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.
ghsa_unreviewed·2026-07-02
CVE-2026-54403 [HIGH] CWE-22 A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-02
Published