garethmsheldon/cve-2026-22557-unifi-detectionDetection content for CVE-2026-22557 — UniFi Network Application unauthenticated path traversal (CVSS 10.0). Includes YARA, Sigma, KQL, Splunk SPL, Sysmon config, and a bash detection script.
| Field | Detail |
|---|
| CVE | CVE-2026-22557 |
| Published | 2026-03-19 |
| CNA | HackerOne |
| CVSS Score | 10.0 CRITICAL |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Vendor | Ubiquiti Inc |
| Product | UniFi Network Application |
A path traversal vulnerability in the UniFi Network Application allows a remote unauthenticated attacker to read arbitrary files from the underlying system. These files can be manipulated to gain access to an underlying account.
| Branch | Affected | Patched |
|---|---|---|
| Stable | < 10.1.89 | 10.1.89 |
| Release Candidate | < 10.2.97 | 10.2.97 |
| UniFi Express (UX) | < 9.0.118 | 9.0.118 |
.
├── docs/
│ └── mitre_attack.md # MITRE ATT&CK mapping
├── kql/
│ └── cve_2026_22557.kql # Microsoft Sentinel / Defender KQL queries
├── sigma/
│ └── cve_2026_22557.yml # Sigma rule for path traversal detection
├── splunk/
│ └── cve_2026_22557.spl # Splunk SPL searches
├── src/
│ └── lab/
│ └── nginx.conf # Lab reverse proxy config for testing
├── sysmon/
│ └── sysmon_config_snippet.xml # Sysmon config additions
├── yara/
│ └── cve_2026_22557.yar # YARA rule for HTTP log scanning
└── detect.sh # Standalone bash detection script
| Artefact | What It Catches |
|---|---|
detect.sh | Version check, log scan, network exposure, file integrity |
yara/ | Path traversal patterns in HTTP access logs |
sigma/ | Generic SIEM rule for web server and UniFi logs |
kql/ | Microsoft Sentinel and Defender for Endpoint queries |
splunk/ | Splunk SPL for web and UniFi log sources |
sysmon/ | File read events from sensitive paths by java.exe / mongod |