CVE-2026-55110: UI Enterprise Firewall Core Firmware
Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.
Affected products
- UI Enterprise Firewall Core Firmware: up to and including 5.1.18
- UI Enterprise Fortress Gateway Firmware: up to and including 5.1.15
- UI Enterprise Network Video Recorder Core Firmware: up to and including 5.1.15
- UI Enterprise Network Video Recorder Firmware: up to and including 5.1.15
- UI Unas 2 Firmware: up to and including 5.1.16
- UI Unas 4 Firmware: up to and including 5.1.16
- UI Unas Pro 4 Firmware: up to and including 5.1.16
- UI Unas Pro 8 Firmware: up to and including 5.1.16
- UI Unas Pro Firmware: up to and including 5.1.16
- UI UniFi Cloud Gateway Fiber Firmware: up to and including 5.1.15
- UI UniFi Cloud Gateway Industrial Firmware: up to and including 5.1.15
- UI UniFi Cloud Gateway Max Firmware: up to and including 5.1.15
- UI UniFi Cloud Gateway Ultra Firmware: up to and including 5.1.15
- UI UniFi Cloud Key Plus Firmware: up to and including 5.1.15
- UI UniFi Cloudkey Enterprise Firmware: up to and including 5.1.15
- UI UniFi Cloudkey Firmware: up to and including 5.1.15
- UI UniFi Dream Machine Beast Firmware: up to and including 5.1.15
- UI UniFi Dream Machine Pro Firmware: up to and including 5.1.15
- UI UniFi Dream Machine Pro Max Firmware: up to and including 5.1.15
- UI UniFi Dream Machine Special Edition Firmware: up to and including 5.1.15
- UI UniFi Dream Router 7 Firmware: up to and including 5.1.15
- UI UniFi Dream Router Firmware: up to and including 5.1.15
- UI UniFi Dream Wall Firmware: up to and including 5.1.15
- UI UniFi Express 7 Firmware: up to and including 5.1.15
- UI UniFi Network Video Recorder Firmware: up to and including 5.1.15
- and 5 more
Published 2026-07-02. Last modified 2026-07-09.