CVE-2026-22557: Ubiquiti UniFi Network Application path traversal
The short version: The Ubiquiti UniFi Network Application has a path-traversal flaw (CVE-2026-22557) that lets an actor with network access read files from the underlying system, which can be manipulated toward account access. It scores a maximum 10.0, but it needs network reach and there's no confirmed in-the-wild exploitation yet. A fix exists — update the controller. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Low — serious, but see the gap below |
| CVSS v3.1 (NVD) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | ~0.03% · low percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not listed in KEV; no confirmed in-the-wild activity at time of writing |
| Vulnerability type | CWE-22 path traversal → file read → potential account access |
| Requires authenticated session? | No — but requires network access to the application |
| Affected | UniFi Network Application (versions prior to the patched release — see vendor advisory) |
| Fixed in | The fixed UniFi Network Application release per Ubiquiti's bulletin |
What you need to know
CVE-2026-22557 is a path traversal in the UniFi Network Application — the controller software that manages UniFi networking gear. An actor with access to the network can craft requests that escape the intended directory and read files on the underlying system, and those files can be manipulated to reach an underlying account.
The honest picture is a headline score with real-world caveats:
- It scores 10.0 because the mechanics — network-reachable, no authentication, scope-changing file access — line up that way.
- But it needs network access to the application, and controllers are frequently on management networks rather than the open internet.
- No confirmed exploitation yet, and EPSS is very low — this isn't (at time of writing) a mass-exploited flaw.
How serious we see it
Low — not the drop-everything Critical the 10.0 implies, and here's why.
The base score is a worst-case mechanical rating; the practical risk depends on reachability. Where the UniFi Network Application is exposed to untrusted networks, treat this as urgent — file read that leads to account access is genuinely serious. But it isn't in KEV, there's no confirmed in-the-wild activity, and EPSS is near the floor, so it doesn't warrant the same panic as an actively exploited perimeter zero-day. Update it promptly, prioritized by how reachable your controller is. It's specific, fixed, and quick to confirm.
Recommendations
Straight from Ubiquiti's advisory:
- Update the UniFi Network Application to the fixed release per the vendor bulletin.
- Keep the controller off untrusted networks. Restrict management access to trusted networks or a VPN — this sharply limits who can even attempt the traversal.
- Review access to the application interface and tighten exposure where it's broader than it needs to be.
- Confirm your exposure first. Verify whether a UniFi Network Application is reachable beyond your management network and which version it runs.
How BreachRisk sees it
BreachRisk discovers internet-facing UniFi controllers from the outside, fingerprints the application, and flags exposure tied to this CVE. Where safe verification is possible, it issues a single bounded, non-destructive request that reads a harmless configuration file to confirm the traversal resolves — proof rather than a version guess, and never a weaponized exploit. That outside-in view answers the first question that matters here: is this controller actually reachable and affected, or safely tucked behind your management boundary?