CVE-2026-110455
8.1HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-20
Impact
Attackers with network access can execute arbitrary commands on the UniFi Protect AI Key. They need network connectivity to the device and specific trigger conditions.
Root cause
Improper input validation allows unsanitized data to trigger command injection.
Affected systems
UniFi Protect AI Key (exact vulnerable version ranges not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade the UniFi Protect AI Key firmware via the UniFi OS console or check vendor release bulletin 070 for target versions; isolate the device on a restricted management VLAN while waiting to patch.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.