CVE-2026-54404

HighCVSS 8.8/10Last modified Jul 10, 2026

Description

A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
Ubiquiti IncUniFi OS Server< 5.1.19
Ubiquiti IncDream Machines< 5.1.19
Ubiquiti IncEnterprise Fortress Gateway< 5.1.19
Ubiquiti IncDream Wall< 5.1.19
Ubiquiti IncDream Routers< 5.1.19
Ubiquiti IncExpress 7< 5.1.19
Ubiquiti IncCloud Keys< 5.1.19
Ubiquiti IncNetwork Video Recorders< 5.1.19
Ubiquiti IncEnterprise Video Recorders< 5.1.19
Ubiquiti IncCloud Gateways< 5.1.19
Ubiquiti IncNetwork Attached Storage< 5.1.19
Ubiquiti IncEnterprise Firewall Core< 5.1.19

References

Timeline

Published
Jul 2, 2026
Last modified
Jul 10, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-544057.5A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to CVE-2026-544068.7A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in self-hosted instancesCVE-2026-544078.6A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to byCVE-2026-544089.8A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to byCVE-2026-544098.1A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UnCVE-2026-54417.1An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routCVE-2026-544108.6nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remotCVE-2026-544115.9Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path inCVE-2026-544128.2LiamBindle MQTT-C versions prior to 1.1.7 contain a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response(CVE-2026-544138.2driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess functioCVE-2026-544149.8FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading CVE-2026-544158.1Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an aut
CVE-2026-54404: High severity, CVSS 8.8 | Vulnix