Looting UniFi Controllers: Detecting and Weaponizing CVE-2026-22557
PatchUniFi Network Application Read at Bishop Fox
Below is the opening; the full story is at Bishop Fox.
From Bishop Fox
TL;DR
CVE-2026-22557 is an unauthenticated path traversal in the UniFi Network Application's guest captive portal, rated CVSS 10.0. It allows attackers to read arbitrary files from any site with a customized portal, including backups containing administrative credentials for all devices managed by the network controller. Patch to 10.1.89, 10.2.97, or 9.0.118 or later. Bishop Fox has published a CVE-2026-22557-check">safe detection tool; read on for the practical attack paths and the conditions for full exploitability.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.