Critical UniFi Vulnerability CVE-2026-22557 (CVSS 10.0) — AyeTech Patched 400+ Sites Within 24 Hours

What Is CVE-2026-22557?

On March 19, 2026, Ubiquiti disclosed a critical vulnerability in UniFi Network Application. The flaw is a path traversal vulnerability — a class of bug that lets attackers navigate outside restricted directories and access files they should not be able to see.

In this case, an attacker with network access to your UniFi controller can traverse the underlying system's directories, read arbitrary files, and ultimately gain control of the controller itself. The vulnerability requires no authentication — just network access.

There is also a secondary vulnerability, CVE-2026-22558, a NoSQL injection flaw (CVSS 7.7) that allows authenticated attackers to escalate privileges and access sensitive network data. Both vulnerabilities are patched in version 10.1.89 or later.

Why CVSS 10.0 Is Maximum Severity

The CVSS (Common Vulnerability Scoring System) scale goes from 0 to 10. A score of 10.0 is the highest possible rating and indicates:

• No authentication required: An attacker doesn't need to log in or provide credentials
• Network accessible: The vulnerability can be exploited remotely over the network
• Complete system compromise: An attacker can gain full control of the affected system
• No user interaction required: The attack doesn't require a user to click a link or take any action
• No complexity: The vulnerability is trivial to exploit — no special skills required

Translation: this is one of the most dangerous types of vulnerability possible.

Which UniFi Systems Are Affected

• UniFi Network Application 10.1.85 and earlier — VULNERABLE
• UniFi Express (UX) 9.0.114 and earlier — VULNERABLE
• Release Candidate 10.2.93 and earlier — VULNERABLE
• UniFi Network Application 10.1.89 or later — PATCHED ✓

How to Check Your Version

1. Log into your UniFi Network Application (usually https://your-controller-ip:8443 or the Ubiquiti Cloud portal)
2. Look in the bottom left corner of the dashboard — your version is displayed there
3. If it says 10.1.85 or earlier, you are vulnerable
4. If it says 10.1.89 or later, you are patched

If you cannot access your controller or do not know your version, contact your IT provider immediately.

What an Attacker Can Do If They Exploit This Vulnerability

This is where the risk becomes very real. A successful exploitation of CVE-2026-22557 gives an attacker access to the complete UniFi controller and everything it manages.

In a business environment, UniFi controller compromise is equivalent to network compromise. An attacker with controller access has visibility and potentially access to every system on your network — file servers, databases, email systems, financial data, everything.

For a 30-person business, an unpatched UniFi controller is an open invitation for a complete breach.

How AyeTech Responded — Why Managed IT Saves You

1. Immediate Detection: AyeTech's security team monitors CVE feeds and Ubiquiti security advisories 24/7. The vulnerability was flagged within hours of publication.
2. Severity Assessment: We assessed the impact — CVSS 10.0, no authentication required, path traversal to account takeover. Verdict: emergency patch situation.
3. Lab Testing: Before deploying to 400 live networks, we tested the patch in our lab environment with real UniFi configurations to ensure stability, verify compatibility, and confirm the patch resolves the vulnerability without breaking anything else.
4. Mass Deployment: Once verified, we deployed the patch across all 400+ managed sites in a coordinated, prioritised fashion — critical infrastructure first, then standard deployments.
5. Verification: We verified that all sites successfully updated and confirmed that no sites were left vulnerable.

Result: All 400+ AyeTech-managed UniFi deployments were patched and secured within 24 hours of the CVE publication.

Why This Matters for Your Business

If you are self-managing your UniFi network:

• You may not even know this CVE exists
• You may not have a monitoring process for new vulnerabilities
• You may not have a lab environment to test patches before deploying
• You may not have the time or expertise to deploy patches across multiple sites
• You may be running vulnerable systems right now without knowing it

This is the fundamental reason managed IT services exist.

What You Should Do Right Now

• Check your UniFi version immediately. Log in and verify you are running 10.1.89 or later. If you are not, this is an emergency.
• If you are vulnerable, update right now. Do not wait. Do not delay. This is a CVSS 10.0 vulnerability.
• Verify the update was successful. After updating, log back in and confirm the version changed.
• If you cannot update yourself, contact an IT provider today. If you have an MSP, call them now. If you don't, contact AyeTech.
• Review your network access policies. Confirm that your UniFi controller is not exposed directly to the internet without authentication controls.
• Check your controller logs. Look for unusual access patterns or failed login attempts that might indicate exploitation attempts.

Why Managed IT Protects You From This

This CVE is one example of dozens that affect networking equipment every year. Fortinet, SonicWall, Cisco, Palo Alto, Ubiquiti — every vendor has critical vulnerabilities. The question is not IF your infrastructure will have vulnerabilities, but HOW FAST you find out about them and patch them.

A Managed IT Provider Does This For You:

• Continuous Monitoring: 24/7 monitoring of CVE databases, vendor security advisories, and industry threat feeds
• Rapid Assessment: When a critical vulnerability is discovered, it is assessed immediately for your specific infrastructure
• Lab Testing: Patches are tested in a controlled environment before being deployed to production
• Coordinated Deployment: Updates are deployed across all managed systems in a prioritised, controlled manner
• Verification: After patching, we verify that all systems are updated and no systems were missed
• Documentation: All patching activity is logged and documented for compliance purposes

This is exactly what AyeTech did for our 400+ managed UniFi sites within 24 hours of the CVE publication.

If you are self-managing, you are betting that you will find out about critical vulnerabilities, understand how to assess them, have the time and expertise to patch them, and do it before your system is compromised. That is not a sustainable bet for a business of any size.