CVE-2026-22557 — UniFi Network Application Detection
| Field | Detail |
|---|
| CVE | CVE-2026-22557 |
| Published | 2026-03-19 |
| CNA | HackerOne |
| CVSS Score | 10.0 CRITICAL |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Vendor | Ubiquiti Inc |
| Product | UniFi Network Application |
Description
A path traversal vulnerability in the UniFi Network Application allows a remote unauthenticated attacker to read arbitrary files from the underlying system. These files can be manipulated to gain access to an underlying account.
Affected Versions
| Branch | Affected | Patched |
|---|
| Stable | < 10.1.89 | 10.1.89 |
| Release Candidate | < 10.2.97 | 10.2.97 |
| UniFi Express (UX) | < 9.0.118 | 9.0.118 |
Repository Structure
.
├── docs/
│ └── mitre_attack.md # MITRE ATT&CK mapping
├── kql/
│ └── cve_2026_22557.kql # Microsoft Sentinel / Defender KQL queries
├── sigma/
│ └── cve_2026_22557.yml # Sigma rule for path traversal detection
├── splunk/
│ └── cve_2026_22557.spl # Splunk SPL searches
├── src/
│ └── lab/
│ └── nginx.conf # Lab reverse proxy config for testing
├── sysmon/
│ └── sysmon_config_snippet.xml # Sysmon config additions
├── yara/
│ └── cve_2026_22557.yar # YARA rule for HTTP log scanning
└── detect.sh # Standalone bash detection script
Detection Coverage
| Artefact | What It Catches |
|---|
detect.sh | Version check, log scan, network exposure, file integrity |
yara/ | Path traversal patterns in HTTP access logs |
sigma/ | Generic SIEM rule for web server and UniFi logs |
kql/ | Microsoft Sentinel and Defender for Endpoint queries |
splunk/ | Splunk SPL for web and UniFi log sources |
sysmon/ | File read events from sensitive paths by java.exe / mongod |
- Patch to the fixed version for your branch (see table above).
- Restrict port 8443 to management networks only. Never expose to the internet.
- Review UniFi logs for traversal patterns prior to patching.
- Rotate credentials if compromise is suspected.
References
garethmsheldon/cve-2026-22557-unifi-detection
