CVE-2026-54404: UI Enterprise Firewall Core Firmware
High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.
Affected products
- UI Enterprise Firewall Core Firmware: up to and including 5.1.18
- UI Enterprise Fortress Gateway Firmware: up to and including 5.1.15
- UI Enterprise Network Video Recorder Core Firmware: up to and including 5.1.15
- UI Enterprise Network Video Recorder Firmware: up to and including 5.1.15
- UI Unas 2 Firmware: up to and including 5.1.16
- UI Unas 4 Firmware: up to and including 5.1.16
- UI Unas Pro 4 Firmware: up to and including 5.1.16
- UI Unas Pro 8 Firmware: up to and including 5.1.16
- UI Unas Pro Firmware: up to and including 5.1.16
- UI UniFi Cloud Gateway Fiber Firmware: up to and including 5.1.15
- UI UniFi Cloud Gateway Industrial Firmware: up to and including 5.1.15
- UI UniFi Cloud Gateway Max Firmware: up to and including 5.1.15
- UI UniFi Cloud Gateway Ultra Firmware: up to and including 5.1.15
- UI UniFi Cloud Key Plus Firmware: up to and including 5.1.15
- UI UniFi Cloudkey Enterprise Firmware: up to and including 5.1.15
- UI UniFi Cloudkey Firmware: up to and including 5.1.15
- UI UniFi Dream Machine Beast Firmware: up to and including 5.1.15
- UI UniFi Dream Machine Firmware: up to and including 5.1.15
- UI UniFi Dream Machine Pro Firmware: up to and including 5.1.15
- UI UniFi Dream Machine Pro Max Firmware: up to and including 5.1.15
- UI UniFi Dream Machine Special Edition Firmware: up to and including 5.1.15
- UI UniFi Dream Router 5g Max Firmware: up to and including 5.1.15
- UI UniFi Dream Router 7 Firmware: up to and including 5.1.15
- UI UniFi Dream Router Firmware: up to and including 5.1.15
- UI UniFi Dream Wall Firmware: up to and including 5.1.15
- and 7 more
Published 2026-07-02. Last modified 2026-07-10.