CVE-2026-55116 is a critical improper access control flaw (CVSS 9.0) in certain devices running UniFi OS. Under certain network configurations, an attacker with network access could make unauthorized changes to the device. The record lists UniFi Connect and gives no versions, so read Ubiquiti Bulletin 066 for fixed releases.
What's affected
- The record lists the product as UniFi Connect, on devices running UniFi OS.
- Affected and fixed versions: not stated in the record. Ubiquiti Security Advisory Bulletin 066 is the vendor source. Its page loads dynamically, so read it in a browser.
- The record says the attack depends on certain network configurations, and it does not say which.
How to check if you're exposed
List your UniFi OS devices, including UniFi Connect, and note the firmware version of each. Compare each with the fixed version in Bulletin 066. Then review how the devices are connected. The record ties the flaw to certain network configurations, so find out whether any device is reachable from networks that should not reach it.
What to do now
- Read Bulletin 066 and find the fixed version for UniFi Connect and UniFi OS.
- Update the affected devices.
- Place management interfaces on a separate network and block access from user and guest networks.
- Check device configuration for changes you did not make.
Why it matters
The class is CWE-284, improper access control. A device allowed changes that should have needed authorization, in some network setups.
The attack complexity in the vector is high, which fits the condition about network configuration. The scope changes, which is why the score reaches 9.0. The record does not mark the CVE as exploited in the wild. Device management planes should not be on networks that ordinary users reach, and that holds whatever the CVE says.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Which network setups are risky?
The record does not say. Read the bulletin, and keep device management off shared networks.
Sources
Last reviewed: 19 October 2026.
