How severe is CVE-2026-22557?

CVE-2026-22557 has a CVSS 3.1 base score of 10 (CRITICAL). EPSS estimates a 28.1% probability of exploitation in the next 30 days.

CVE-2026-22557: Ubiquiti Inc UniFi Network Application

Description

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.

Severity

CVSS 3.1 · CNA10 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationnone

Automatableyes

Technical impacttotal

Exploitation Context

as of October 17, 2026

All KEV statistics→

Its current EPSS score (28.1%) is higher than that of 40% of CISA KEV entries.

Affected Products

Vendor	Product	Affected versions
Ubiquiti Inc	Ubiquiti Inc UniFi Network Application	10.1.89 to <10.1.89 10.2.97 to <10.2.97 9.0.118 to <9.0.118

References

1 Links

Other references

https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b

Record Details

Published

2026-03-19

Last updated

2026-03-19

Assigner (CNA)

hackerone

Credited to

More from Ubiquiti Inc

CVE-2026-3491010 CRITICAL

Ubiquiti UniFi OS Improper Input Validation Vulnerability

Ubiquiti IncKEVEPSS 45.8%2026-05-22

CVE-2026-3490810 CRITICAL

Ubiquiti UniFi OS Improper Access Control Vulnerability

Ubiquiti IncKEVEPSS 15.2%2026-05-22

CVE-2026-3490910 CRITICAL

Ubiquiti UniFi OS Path Traversal Vulnerability

Ubiquiti IncKEVEPSS 1.8%2026-05-22

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.