Ubiquiti UniFi Access improper access control (Bulletin 066)
Improper access control in Ubiquiti UniFi Access lets a network attacker with existing high privileges escalate on the host device. CVSS 9.1. Fixed in the patch release accompanying Bulletin 066.
- Vendor
- Ubiquiti
- Product
- UniFi Access
- CVSS
- 9.1
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-54400 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-54400 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-21 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-54400 is a CVSS 9.1 critical improper access control in Ubiquiti UniFi Access. Per Security Advisory Bulletin 066, it lets a network attacker with existing high privileges escalate on the host device. It is one of seven critical CVEs disclosed in the same bulletin, headlined by CVE-2026-50746 (CVSS 10.0, command injection in UniFi Connect).
For authoritative affected-version details and patch guidance, see the NVD record and Ubiquiti’s Bulletin 066.
No confirmed exploitation in the wild as of publication. Not on CISA KEV at time of writing.
Full coverage: Ubiquiti Patches Max-Severity UniFi Connect Command Injection.
Other Ubiquiti CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-77554 UniFi Talk command injection — unauthenticated remote code executionwrite-up | [ CRITICAL ] | 10.0 | 1.6% | — |
| CVE-2026-77550 UniFi OS CRLF injection — authentication bypasswrite-up | [ CRITICAL ] | 10.0 | 0.8% | — |
| CVE-2026-77537 UniFi Protect Application improper input validation — unauthenticated RCEwrite-up | [ CRITICAL ] | 10.0 | 1.6% | — |
| CVE-2026-50748 Ubiquiti UniFi critical flaw (Bulletin 066)write-up | [ CRITICAL ] | 9.9 | 1.6% | — |
| CVE-2026-50747 Ubiquiti UniFi critical flaw (Bulletin 066)write-up | [ CRITICAL ] | 9.9 | 0.5% | — |
| CVE-2026-50746 Ubiquiti UniFi Connect command injection (Bulletin 066)write-up | [ CRITICAL ] | 10.0 | 1.7% | — |
| CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation Vulnerability | [ CRITICAL ] | 10.0 | 45.8% | |
| CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability | [ CRITICAL ] | 10.0 | 1.8% |
