External risk intelligence

UniFi OS Improper Access Control Vulnerability Allows Unauthorized Changes

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-55116

UniFi OS devices often function as network gateways, controllers, or management appliances that are commonly deployed in internet-facing roles to facilitate remote administration and network management, making their management interfaces or services frequently reachable from the public internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An Improper Access Control vulnerability has been identified in certain UniFi OS devices, potentially allowing unauthorized modifications. This issue matters because it could enable malicious actors to alter device configurations if they have network access and specific network setups. The primary concern is to confirm if our environment is affected and what the potential exposure might be.

Unauthorized changes possible to UniFi devices.
Matters for network control and data integrity.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target UniFi OS devices that are exposed to the network. By exploiting an improper access control flaw, an unauthorized individual could make unwanted modifications to the device's settings.

Network access required.
Exploits improper access control.
Unauthorized device changes possible.

Live Threat

Current exploitation, exposure, and threat context

An attacker on the network, given specific configurations, could potentially alter UniFi OS devices. This vulnerability may impact the device's configuration and integrity, leading to unauthorized modifications.

Device configuration and integrity.
Unauthorized changes via network access.
Compromised device functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

This Improper Access Control vulnerability in UniFi OS devices requires immediate attention from network and security teams, as well as potentially infrastructure or platform owners depending on device deployment. The first practical step is to identify all UniFi OS devices within the environment, determine their network exposure and business criticality, and then assign ownership for remediation planning.

Own the issue: Network and security teams.
Verify first: Device network exposure and criticality.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is UniFi OS and how is it used?

UniFi OS is a centralized operating system used in networking hardware, such as gateways and controllers, to manage local networks and connected devices. It acts as the brain for these appliances, enabling administrators to configure network traffic, security settings, and device performance through a unified management interface.

What does Improper Access Control mean for CVE-2026-55116?

This vulnerability, classified as CWE-284, refers to a failure in the device's permission logic. It means the system does not correctly verify whether a user has the right to perform specific actions. In this case, it allows an unauthorized person to bypass those checks and make configuration changes to the UniFi OS device that should otherwise be restricted.

How does an attacker trigger this vulnerability?

An attacker needs network access to the device and specific network configurations to exploit this flaw. It is not triggered by simple presence on a network alone; the device must be set up in a particular way for the improper access control to be bypassed. Standard, secure configurations that do not meet these specific conditions may not be immediately susceptible to the exploit path.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that UniFi OS devices often function as network gateways or management appliances, which are frequently placed in internet-facing roles to allow for remote administration. If your device is reachable from the public internet, it falls into the category of higher risk because attackers could potentially reach it without needing to be physically present on your local network.

Do I need to take immediate action for this CVE?

Yes, you should prioritize this issue. Start by identifying all UniFi OS devices in your environment and checking if they are reachable from the internet. Once you have a list of these devices and understand their role in your network, you can determine which ones require the most urgent attention and assign ownership to ensure they are updated according to the manufacturer's guidance.

References

community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.