Skip to content
OpenAdvisories
High · 7.7 CVE-2026-54401 EUVD-2026-41392GHSA-j9mg-7mrv-2wwc

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges w…

Published Jul 2, 2026 · Updated Jul 2, 2026 · Assigned by hackerone

Vendor: Ubiquiti Product: Cloud Gateways Product: Cloud Keys Product: Dream Machines Product: Dream Routers Product: Dream Wall Product: Enterprise Firewall Core Product: Enterprise Fortress Gateway Product: Enterprise Video Recorders Product: Express 7 Product: Network Attached Storage Product: Network Video Recorders Product: UniFi OS Server Category: Network devices

Description

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.

Affected products

VendorProductAffectedFixed
Ubiquiti UniFi OS Server < 5.1.19 5.1.19
Ubiquiti Dream Machines < 5.1.19 5.1.19
Ubiquiti Enterprise Fortress Gateway < 5.1.19 5.1.19
Ubiquiti Dream Wall < 5.1.19 5.1.19
Ubiquiti Dream Routers < 5.1.19 5.1.19
Ubiquiti Express 7 < 5.1.19 5.1.19
Ubiquiti Cloud Keys < 5.1.19 5.1.19
Ubiquiti Network Video Recorders < 5.1.19 5.1.19
Ubiquiti Enterprise Video Recorders < 5.1.19 5.1.19
Ubiquiti Cloud Gateways < 5.1.19 5.1.19
Ubiquiti Network Attached Storage < 5.1.19 5.1.19
Ubiquiti Enterprise Firewall Core < 5.1.19 5.1.19

Advisories 2

References