CVE-2026-55112 Privilege escalation in Cloud Gateways
A low-privileged network attacker can escalate privileges on UniFi OS devices via an improper access control flaw in the Protect application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55112?
CVE-2026-55112 is a high-severity vulnerability in Ubiquiti Inc Cloud Gateways, published on 2 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device.
Weakness: CWE-284
Which versions are affected by CVE-2026-55112?
It affects 19 products.
Products include Ui Enterprise Network Video Recorder Core Firmware, Ui Enterprise Network Video Recorder Firmware, Ui Unifi Cloud Gateway Fiber Firmware, Ui Unifi Cloud Gateway Industrial Firmware, Ui Unifi Cloud Gateway Max Firmware, Ui Unifi Cloudkey Firmware and 13 more.
How do I fix CVE-2026-55112?
No fix has been published for CVE-2026-55112 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-55112 being exploited?
There is no known exploitation of CVE-2026-55112 in the wild and no public exploit code.
Sources
Also known as GHSA-8jvx-73vq-fvch.