CVE-2026-54401

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.

• ui unifi os server (<= 5.1.15) • ui unifi dream machine firmware (<= 5.1.15) • ui unifi dream machine pro firmware (<= 5.1.15) • ui unifi dream machine special edition firmware (<= 5.1.15) • ui unifi dream machine pro max firmware (<= 5.1.15) • ui unifi dream machine beast firmware (<= 5.1.15) • ui enterprise fortress gateway firmware (<= 5.1.15) • ui unifi dream router firmware (<= 5.1.15) • ui unifi dream wall firmware (<= 5.1.15) • ui unifi dream router 7 firmware (<= 5.1.15) • ui unifi express 7 firmware (<= 5.1.15) • ui unifi cloudkey firmware (<= 5.1.15) • ui unifi cloud key plus firmware (<= 5.1.15) • ui unifi cloudkey enterprise firmware (<= 5.1.15) • ui unifi network video recorder firmware (<= 5.1.15) • ui unifi network video recorder pro firmware (<= 5.1.15) • ui unifi network video recorder instant firmware (<= 5.1.15) • ui enterprise network video recorder firmware (<= 5.1.15) • ui enterprise network video recorder core firmware (<= 5.1.15) • ui unifi network video recorder g2 firmware (<= 5.1.15) • ui unifi network video recorder g2 pro firmware (<= 5.1.15) • ui unifi cloud gateway ultra firmware (<= 5.1.15) • ui unifi cloud gateway max firmware (<= 5.1.15) • ui unifi cloud gateway industrial firmware (<= 5.1.15) • ui unifi cloud gateway fiber firmware (<= 5.1.15) • ui unas 2 firmware (<= 5.1.16) • ui unas 4 firmware (<= 5.1.16) • ui unas pro firmware (<= 5.1.16) • ui unas pro 4 firmware (<= 5.1.16) • ui unas pro 8 firmware (<= 5.1.16) • ui enterprise firewall core firmware (<= 5.1.18) • ui unifi dream router 5g max firmware (<= 5.1.15)