Ubiquiti defect poses account takeover risk for UniFi Networking Application users

Ubiquiti disclosed and patched a critical CVSS 10 path-traversal vulnerability (CVE-2026-22557) in the UniFi Network Application that can enable unauthenticated remote account takeover, alongside a privilege-escalation bug (CVE-2026-22558). Censys observed roughly 88,000 UniFi Network Application hosts exposed to the internet, many in the U.S.; although no public proof-of-concept or confirmed exploitation had been observed, the low exploitation complexity and high exposure make rapid patching imperative.