CVE-2026-54404

HighCVSS 8.8/10Last modified Jul 10, 2026

Description

A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 2, 2026
Last modified: Jul 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-544057.5A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to CVE-2026-544068.7A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in self-hosted instances CVE-2026-544078.6A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to by CVE-2026-544089.8A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to by CVE-2026-544098.1A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in Un CVE-2026-54417.1An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression rout CVE-2026-544108.6nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remot CVE-2026-544115.9Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in CVE-2026-544128.2LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response f CVE-2026-544138.2driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess functio CVE-2026-544149.8FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading CVE-2026-544158.1Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an aut