CRITICAL UBIQUITI UNIFI UNIFI SECURITY FLAW ALLOWS POTENTIAL ACCOUNT HIJACKING

Summary from the TLDR InfoSec newsletter

Ubiquiti patched CVE-2026-22557 (CVSS 10.0), a path traversal flaw in UniFi Network Application v10.1.85 and earlier enabling account takeover, alongside CVE-2026-22558 (CVSS 7.7), an authenticated NoSQL injection enabling privilege escalation.