Critical Ubiquiti UniFi UniFi security flaw allows potential account hijacking

2026-03-20

Ubiquiti patched CVE-2026-22557 (CVSS 10.0), a path traversal flaw in UniFi Network Application v10.1.85 and earlier enabling account takeover, alongside CVE-2026-22558 (CVSS 7.7), an authenticated NoSQL injection enabling privilege escalation.