CVE-2026-22557

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.

CVSS v3.1

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

28.12% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-22

Published

2026-03-19

Proof-of-concept exploits (3)

• 0xBlackash/CVE-2026-225573★ · 2026-04-05
• ThePotatoOfDoom/CVE-2026-22557-PoC4★ · 2026-04-11
• gagaltotal/CVE-2026-22557-Path-Traversal-Ubiquti-UniFi0★ · 2026-06-30

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22557.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-41773
• CVE-2025-55182
• CVE-2025-68613
• CVE-2026-10520
• CVE-2026-10523
• CVE-2026-23918