CVE-2026-22557

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 28.67%
EPSS Percentile: 98.15%
CISA KEV: Not listed

Description

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 19-Mar-2026 22:16
Last Modified: 17-Jun-2026 17:20
EPSS Date: 2026-11-06
CWE: CWE-22

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

Ubiquiti Inc · UniFi Network Application Source: CNA · [email protected]
Default status: unaffected

10.1.89 ≤ version < 10.1.89 — affected (semver)
10.2.97 ≤ version < 10.2.97 — affected (semver)
9.0.118 ≤ version < 9.0.118 — affected (semver)

References

[email protected]

Last enrichment sync: 07-Nov-2026 02:16
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Ubiquiti UniFi: CVE-2026-22557 is a maximum-severity vulnerability in Ubiquiti’s UniFi Network Application that was published on March 19. Sysdig’s March 2026 Briefing Tracks Rapid Exploitation and TeamPCP Supply-Chain Attacks

CVE (4)

People (1)

Threat Actors (1)

MITRE ATT&CK (5)

Vendors (8)

Products (10)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.