CVE-2026-55115: UniFi Protect Server-Side Request Forgery Privilege Escalation - What It Means for Your Business and How to Respond

CVE-2026-55115: UniFi Protect Server-Side Request Forgery Privilege Escalation - What It Means for Your Business and How to Respond

Introduction

CVE-2026-55115 is a critical vulnerability in Ubiquiti’s UniFi Protect Application, the software many organizations across the United States and Canada rely on to manage video surveillance, cameras, and related security systems. If left unaddressed, an attacker who already has limited access on your network can use this flaw to gain much higher control over the host device running Protect. That elevated access can expose recorded video, live feeds, camera configurations, and potentially the broader network infrastructure that supports your physical security operations.

Businesses of all sizes that deploy UniFi Protect for office, retail, warehouse, campus, or multi-site surveillance are within scope. This post explains why the vulnerability matters to decision-makers, outlines the practical risks to operations and compliance, provides real-world scenarios, and offers a clear checklist so you can determine whether your environment is affected. A technical appendix follows for security and IT teams who need deeper detail.

S1 — Background & History

Ubiquiti published details of CVE-2026-55115 on July 2, 2026, as part of Security Advisory Bulletin 066. The vulnerability affects the UniFi Protect Application. It is classified as a server-side request forgery issue that enables privilege escalation on the host device. The Common Vulnerability Scoring System base score is 9.9, placing it in the Critical severity range.

In plain language, an attacker who already holds low-level privileges and can reach the Protect application over the network can force the system to make requests that ultimately grant higher privileges. No user interaction is required once the attacker has that initial foothold. The affected versions are UniFi Protect Application 7.1.77 and earlier. Ubiquiti released version 7.1.83 and later as the official fix. Public reporting from multiple security sources confirmed the details shortly after the advisory, and organizations were urged to apply the update promptly. Disclosure occurred in early July 2026, with the advisory updated in the following weeks.

S2 — What This Means for Your Business

For business leaders, the core issue is straightforward: a low-privilege foothold on your network can become full control of the system that records and manages your surveillance video. Operations can be disrupted if cameras go offline, recordings are altered or deleted, or live monitoring becomes unreliable. Sensitive visual data, including footage of employees, customers, visitors, or high-value areas, may be viewed, copied, or manipulated by an unauthorized party.

Reputation risk follows quickly. A confirmed compromise of physical security systems often attracts media attention and erodes trust with clients, partners, and regulators. In the United States and Canada, organizations subject to data-protection rules, industry standards, or contractual security requirements may face compliance exposure if video records containing personal information are accessed without authorization. Insurance claims and incident-response costs can rise. Even without public disclosure, internal investigations and remediation divert staff time and budget from core activities. The combination of high impact and relatively low barriers once network access exists makes timely response essential for any organization running UniFi Protect.

S3 — Real-World Examples

Regional retail chain: An attacker with limited network access escalates privileges on a UniFi Protect server that covers multiple store locations. Live camera feeds and archived footage of point-of-sale areas become available, creating both theft risk and potential privacy issues for staff and customers. Operations teams lose reliable monitoring during peak hours while the incident is investigated.

Mid-size professional services firm: Privilege escalation on the Protect host allows the attacker to disable recording schedules or delete selected archives. The firm later discovers gaps in evidence needed for an internal investigation, complicating legal and human-resources processes and raising questions from external counsel.

Healthcare clinic group: Compromised Protect systems expose video of patient waiting and treatment areas. Beyond the immediate privacy concerns under applicable health-information rules, the organization must notify affected parties and demonstrate that physical-security controls have been restored, delaying normal operations.

University campus facilities team: Escalated access on shared UniFi Protect infrastructure serving several buildings enables the attacker to alter camera configurations across sites. Security staff lose centralized visibility, and the institution faces both safety and compliance questions until systems are verified and restored.

S4 — Am I Affected?

• You are running UniFi Protect Application version 7.1.77 or earlier.
• Your UniFi Protect instance is reachable from any network segment where low-privilege accounts or devices exist.
• You manage cameras, video recording, or related Protect features on UniFi hardware or software that has not been updated to 7.1.83 or later.
• Your organization uses UniFi Protect for multi-site, branch, or campus surveillance without recent version confirmation.
• Low-privilege users or systems on the same network can authenticate to Protect or related UniFi services.

Key Takeaways

• CVE-2026-55115 is a critical flaw that turns limited network access into elevated control of UniFi Protect systems.
• Business impact centers on loss of video integrity, operational disruption, privacy exposure, and potential compliance costs.
• Organizations across retail, professional services, healthcare, education, and similar sectors that rely on UniFi Protect face elevated risk until patched.
• Confirming your Protect version and applying the vendor update is the primary defensive step.
• Restricting network access to management interfaces and reviewing privilege levels further reduce exposure while updates are deployed.

Call to Action

Protecting physical security systems is a core business responsibility. IntegSec helps organizations across the United States and Canada identify, validate, and reduce exposure from vulnerabilities such as CVE-2026-55115 through targeted penetration testing and practical risk assessments. Contact us today to schedule a focused review of your UniFi environment and strengthen your overall cybersecurity posture. Visit https://integsec.com to begin the conversation.

TECHNICAL APPENDIX (security engineers, pentesters, IT professionals only)

A — Technical Analysis

CVE-2026-55115 is a server-side request forgery vulnerability (CWE-918) in the UniFi Protect Application. A low-privileged attacker with network access can abuse the SSRF to force the application to issue requests that result in privilege escalation on the host device. The attack vector is network-based (AV:N), with low attack complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N). Scope is changed (S:C), and impacts to confidentiality, integrity, and availability are all high (C:H/I:H/A:H), producing the CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H vector and a 9.9 base score. Affected versions are UniFi Protect Application prior to 7.1.83 (specifically 7.1.77 and earlier). The NVD entry and Ubiquiti Security Advisory Bulletin 066 provide the authoritative references. No public proof-of-concept details beyond the high-level description were required for scoring.

B — Detection & Verification

Version enumeration is performed through the UniFi Protect administrative interface or by querying the application’s version endpoint where exposed. Vulnerability scanners that include signatures for CVE-2026-55115 or the broader Bulletin 066 set will flag instances running versions below 7.1.83. Log indicators include unusual outbound requests originating from the Protect process to internal or unexpected destinations, especially those correlated with low-privilege authentication events. Behavioral anomalies may appear as unexpected privilege changes or access to host-level resources by the Protect service account. Network monitoring can surface SSRF-related traffic patterns, such as requests that traverse internal boundaries without corresponding legitimate application activity.

C — Mitigation & Remediation

1. Immediate (0–24h): Apply the official Ubiquiti update to UniFi Protect Application version 7.1.83 or later on all affected instances. Restrict network access to the Protect management interface to trusted administrative segments only.
2. Short-term (1–7d): Verify successful update across all sites, review authentication logs for anomalous low-privilege activity preceding any privilege changes, and confirm that cameras and recording services function normally after the upgrade. Implement network segmentation that isolates Protect hosts from general user and device networks where possible.
3. Long-term (ongoing): Maintain a regular patch cadence for UniFi applications, enforce least-privilege access for all accounts that interact with Protect, and include UniFi Protect in continuous vulnerability scanning and penetration-testing scopes. For environments that cannot patch immediately, isolate the Protect host behind strict firewall rules that limit inbound access to known administrative sources and monitor for SSRF indicators until the update can be applied.

Official vendor patches remain the primary remediation. Interim network controls reduce the attack surface while updates are scheduled.

D — Best Practices

• Enforce strict network segmentation so that UniFi Protect management interfaces are reachable only from dedicated administrative networks.
• Apply the principle of least privilege to all accounts that authenticate to Protect, limiting the impact of any initial foothold.
• Maintain an accurate inventory of UniFi Protect versions and schedule timely application of vendor security updates.
• Monitor application and host logs for unexpected outbound requests or privilege escalations originating from the Protect process.
• Include UniFi Protect and related UniFi OS components in regular penetration tests and vulnerability assessments focused on privilege-escalation paths.