CVE-2026-110459
8.6HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-284
Impact
Unauthenticated network attackers can read sensitive data, alter device settings, and crash the UniFi Protect AI Key. They only need network access to reach the device.
Root cause
Improper access control allows unauthorized remote network requests to bypass security checks.
Affected systems
UniFi Protect AI Key; exact versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Fix & remediation
Upgrade the UniFi Protect AI Key firmware via UniFi OS to the fixed release specified in Ubiquiti bulletin 070. If immediate patching is not possible, isolate the device on a restricted management VLAN away from untrusted network traffic.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.