CVE-2026-54400 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-54400 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-54400 is an Improper Access Control vulnerability in Ubiquiti's UniFi Access Application that allows a network-adjacent, highly privileged attacker to escalate privileges on the underlying host device.

Technical Detail

The flaw exists within the UniFi Access Application's access control logic, where privilege boundaries are not properly enforced for authenticated high-privilege users operating over the network. An attacker who already holds elevated credentials within the application can exploit this control gap to move beyond their intended permission scope and gain elevated or administrative access on the host system itself. The confirmed impact is privilege escalation, which in practice could allow full host compromise, persistence, or lateral movement depending on the host environment.

Exploitation Status

No known exploit exists for this vulnerability at this time. It is not listed in CISA's Known Exploited Vulnerabilities catalog. There is no public proof-of-concept code or reported in-the-wild exploitation as of July 09, 2026. Despite the absence of active exploitation, the critical CVSS score of 9.1 warrants prompt remediation.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability in available intelligence sources.

What To Do

Apply any available patch or update for the UniFi Access Application from Ubiquiti as the primary remediation step. Organizations should check the Ubiquiti security advisory portal for the patched version and prioritize deployment given the critical severity rating. As an interim measure, restrict network access to the UniFi Access Application management interface to trusted administrative hosts only, and audit current high-privilege account assignments to reduce the pool of accounts that could be leveraged in an attack. Enable logging on the UniFi Access Application and monitor for anomalous privilege changes or unexpected administrative actions on the host system. Because the attack requires network access and high privileges, enforcing strict role-based access control and network segmentation around the management plane will reduce exposure while patching is completed.