CVE-2026-56841

A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application to escalate privileges on the host device.

Score

CVSS 3.1 8.8 High

Status

Analyzed - support@hackerone.com

Published

2026-07-02

Last modified

2026-10-25

Weaknesses

CWE-89

Affected products

• Unifi Protect Application (Ubiquiti Inc)
• Unifi Protect (Ui)

References

• https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc