← Vulnerability feed

Vulnerability record · CVE-2026-55110 · published 2 July 2026

CVE-2026-55110: Ui unifi os server vulnerability

Ui · Unifi Os Server

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.

6.1 CVSS 3.1 Medium EPSS 0.27% · top 82.7% CWE-942 · CWE-942 Undergoing Analysis
6.1CVSS 3.1 base score
0.27%EPSS exploitation probability, 30 days
NoNot in CISA KEV
30Affected product versions listed by NVD
1References
9 Jul 2026Last modified by NVD

Description

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

30 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc Vendor Advisory

Track CVE-2026-55110 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-34908Ubiquiti UniFi OS improper access control allows unauthorized system changesUniFi OS devices contain an improper access control flaw (CWE-284) that lets a network-reachable actor make unauthorized changes to the system. The C…KEVEPSS 15%analysed10.0CVE-2026-34909UniFi OS path traversal allows unauthenticated file accessUniFi OS devices contain a path traversal flaw (CWE-22) that lets a network-reachable attacker read files on the underlying system. Because the expos…KEVEPSS 1.8%analysed10.0CVE-2026-34910Ubiquiti UniFi OS input validation flaw allows command injectionUniFi OS devices contain an improper input validation vulnerability (CWE-20) that lets a network-reachable attacker inject and execute commands. It a…KEVEPSS 46%analysed8.8CVE-2026-55112Ui unifi dream machine pro firmware improper access control vulnerabilityA malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability f…EPSS 0.36%8.8CVE-2026-54404Ui unifi dream machine beast firmware sql injection vulnerabilityA malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi …EPSS 0.49%8.8CVE-2026-54401Ui unifi os server server-side request forgery (ssrf) vulnerabilityA malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such…EPSS 0.43%8.8CVE-2026-54402Ui unifi os server improper input validation vulnerabilityA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute…EPSS 1.8%8.6CVE-2026-54403Ui unifi os server path traversal vulnerabilityA malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authent…EPSS 0.77%

Source: NIST National Vulnerability Database (record CVE-2026-55110), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.