Ubiquiti UniFi Vulnerabilities Allow Privilege Escalation

CERT-Bund has released a critical security advisory (WID-SEC-2026-0784) concerning multiple vulnerabilities in Ubiquiti's UniFi Network Application and UniFi Express. These flaws, which have a CVSS Base Score of 10.0, allow remote attackers to escalate privileges. The advisory specifically lists affected versions of the UniFi Network Application (versions prior to 10.1.89, 10.2.97, and 9.0.118) and UniFi Express (versions prior to 4.0.13).

Organizations utilizing these Ubiquiti products must urgently review their systems for the affected versions. Immediate mitigation is recommended, which typically involves updating the software to a patched version. Failure to address these vulnerabilities could lead to unauthorized access and control over network infrastructure, posing a significant risk to data confidentiality, integrity, and system availability. While no specific compliance deadline is stated, prompt action is crucial due to the critical nature of the vulnerabilities.