CVE-2026-22557
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the...
- Published
- Mar 19, 2026
- Updated
- Mar 19, 2026
- Assigning CNA
- hackerone
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HModerate · next 30 days
- Percentile
- 98.1%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.
Sources
http/cves/2026/CVE-2026-22557.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)
- CVE-2026-22557Informational
CVE-2026-22557
- cve-2026-22557-unifi-detectionDetection
Detection content for CVE-2026-22557 — UniFi Network Application unauthenticated path traversal (CVSS 10.0). Includes YARA, Sigma, KQL, Splunk SPL, Sysmon config, and a bash detection script.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.