Read the docs
TI-2026-39814 Aliases CVE-2026-55116GHSA-hh99-693c-cjm3

Improper access control in Ubiquiti Dream Machines

Priority MEDIUM 43CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00412 35th percentileScored 2026-11-07
Fix Fixed Dream Machines (Ubiquiti Inc): 5.1.19Enterprise Fortress Gateway (Ubiquiti Inc): 5.1.19+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UbiquitiDream Machinesbefore 5.1.195.1.19Patch availableCNA
UbiquitiEnterprise Fortress Gatewaybefore 5.1.195.1.19Patch availableCNA
UbiquitiDream Wallbefore 5.1.195.1.19Patch availableCNA
UbiquitiDream Routersbefore 5.1.195.1.19Patch availableCNA
UbiquitiExpress 7before 5.1.195.1.19Patch availableCNA
UbiquitiCloud Gatewaysbefore 5.1.195.1.19Patch availableCNA
UbiquitiEnterprise Firewall Corebefore 5.1.195.1.19Patch availableCNA
  • Dream Machines VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
  • Enterprise Fortress Gateway VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
  • Dream Wall VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
  • Dream Routers VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
  • Express 7 VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
  • Cloud Gateways VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
  • Enterprise Firewall Core VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ui:unifi_connect:*:*:*:*:*:*:*:*before 3.4.20VulnerableUbiquiti
  • cpe:2.3:a:ui:unifi_connect:*:*:*:*:*:*:*:* Versions before 3.4.20 Vulnerable ·Ubiquiti

Remediation

  • Fix · CNA Dream Machines (Ubiquiti Inc) Fixed in 5.1.19
  • Fix · CNA Enterprise Fortress Gateway (Ubiquiti Inc) Fixed in 5.1.19
  • Fix · CNA Dream Wall (Ubiquiti Inc) Fixed in 5.1.19
  • Fix · CNA Dream Routers (Ubiquiti Inc) Fixed in 5.1.19
  • Fix · CNA Express 7 (Ubiquiti Inc) Fixed in 5.1.19
  • Fix · CNA Cloud Gateways (Ubiquiti Inc) Fixed in 5.1.19
  • Fix · CNA Enterprise Firewall Core (Ubiquiti Inc) Fixed in 5.1.19

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Ubiquiti Cloud Gateways, Dream Machines and 2 more products 5.1.19

    7 records Highest priority Priority MEDIUM 5 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-39278 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 46
    • TI-2026-39279 Path traversal in Ubiquiti UniFi OS ServerPriority MEDIUM 45
    • TI-2026-39280 SQL injection in Ubiquiti UniFi OS ServerPriority MEDIUM 41
    Show all 7 records →
  • Release ·

    Ubiquiti Enterprise Firewall Core, Enterprise Fortress Gateway, Express 7 5.1.19

    6 records Highest priority Priority MEDIUM 4 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-39278 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 46
    • TI-2026-39279 Path traversal in Ubiquiti UniFi OS ServerPriority MEDIUM 45
    • TI-2026-39280 SQL injection in Ubiquiti UniFi OS ServerPriority MEDIUM 41
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55116
  2. 2026-10-03 Alias added: GHSA-hh99-693c-cjm3

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences