CVE-2026-56841

HIGH

Ubiquiti INC UniFi Protect Application < 7.1.83 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: rule

Description

A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application to escalate privileges on the host device.

References (1)

Core 1

Core References

https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc

Scores

CVSS v3 8.8

EPSS 0.0024

EPSS Percentile 15.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-89

Status published

Products (2)

Ubiquiti Inc/UniFi Protect Application < 7.1.83

ui/unifi_protect < 7.1.83

Published Jul 02, 2026

Tracked Since Jul 02, 2026