Total Takeover: Critical 10.0 CVSS Path Traversal Flaw Hits Ubiquiti UniFi Networks

Ubiquiti issued an urgent advisory for two vulnerabilities in the UniFi Network Application: a Critical unauthenticated Path Traversal (CVE-2026-22557, CVSS 10.0) enabling potential full system compromise, and a High authenticated NoSQL Injection (CVE-2026-22558, CVSS 7.7) that can escalate privileges. The advisory lists affected release branches (Official Release, Release Candidate, UniFi Express UX) and directs users to update to Official 10.1.89+, RC 10.2.97+, or UX firmware 4.0.13 (App 9.0.118) to remediate the issues.