CVE-2026-110454 Overview
CVE-2026-110454 is an Improper Access Control vulnerability [CWE-284] affecting Ubiquiti UniFi Protect AI Key. A malicious actor with network access to the device can leverage the flaw to reach internal resources through the AI Key, bypassing intended access boundaries.
The issue requires no authentication and no user interaction, and it is exploitable from an adjacent or routed network path. Successful exploitation exposes confidential information reachable through the device, though it does not directly impact integrity or availability.
Critical Impact
Unauthenticated network-based attackers can pivot through the UniFi Protect AI Key to access internal network resources that should not be reachable from the exposed interface.
Affected Products
- Ubiquiti UniFi Protect AI Key
- Networks exposing the UniFi Protect AI Key management or service interface
- Deployments without network segmentation isolating the AI Key device
Discovery Timeline
- 2026-10-14 - CVE-2026-110454 published to the National Vulnerability Database (NVD)
- 2026-10-14 - Last updated in NVD database
- 2026-10-14 - Ubiquiti publishes Security Advisory Bulletin #070
Technical Details for CVE-2026-110454
Vulnerability Analysis
The UniFi Protect AI Key is a dedicated appliance that runs Ubiquiti's AI-driven video analytics for UniFi Protect deployments. The device exposes network services used for management and inter-device communication within a Protect ecosystem.
CVE-2026-110454 stems from improper access control on one or more of those exposed services. The device fails to adequately validate whether a requester is authorized to reach a given resource. An attacker who can send traffic to the AI Key can therefore use it as a stepping stone to internal resources the device can reach.
The vulnerability is classified under CWE-284: Improper Access Control. It does not require credentials, user interaction, or elevated privileges.
Root Cause
The root cause is missing or incomplete authorization enforcement on request handling within the AI Key firmware. Access decisions do not sufficiently verify the identity, origin, or privilege level of the caller before routing requests to internal functionality or resources accessible from the device.
Attack Vector
The attack vector is Network. An attacker reaches the AI Key over the LAN or any routed path that permits traffic to the device. The attacker issues requests that the device accepts and processes without proper access checks, resulting in disclosure of information from internal resources. Full technical specifics are documented in the vendor advisory. See the Ubiquiti Security Advisory Bulletin #070 for details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-110454
Indicators of Compromise
- Unexpected inbound connections to the UniFi Protect AI Key from untrusted VLANs, management networks, or guest segments.
- Outbound connections initiated from the AI Key to internal hosts or services that fall outside its normal Protect communication patterns.
- Spikes in request volume to the AI Key's HTTP or API endpoints from a single source.
Detection Strategies
- Baseline the AI Key's normal network conversations and alert on new destinations, protocols, or ports.
- Inspect firewall and switch logs for east-west traffic traversing the AI Key toward sensitive internal subnets.
- Correlate authentication-free access attempts against the device with downstream access to internal resources.
Monitoring Recommendations
- Enable flow logging (NetFlow, sFlow, or IPFIX) on the switch ports and gateway serving the AI Key.
- Forward UniFi Protect and AI Key logs to a central SIEM or data lake for retention and correlation.
- Alert on administrative API calls to the AI Key that originate outside approved management ranges.
How to Mitigate CVE-2026-110454
Immediate Actions Required
- Apply the firmware update referenced in Ubiquiti Security Advisory Bulletin #070 as soon as it is available for your deployment.
- Restrict network reachability to the AI Key to a dedicated management VLAN with explicit allow-lists.
- Audit which internal resources the AI Key can reach and remove unnecessary routes or firewall permissions.
Patch Information
Ubiquiti addresses CVE-2026-110454 through firmware updates distributed with Security Advisory Bulletin #070. Administrators should consult the advisory for the specific fixed firmware versions applicable to their UniFi Protect AI Key hardware revision and update through the UniFi Protect console or Ubiquiti update mechanisms.
Workarounds
- Place the UniFi Protect AI Key behind a firewall rule set that only permits traffic from the UniFi Protect controller and authorized administrators.
- Segment the device onto an isolated VLAN with no routable path to sensitive internal servers, management interfaces, or identity systems.
- Disable or block any exposed management interfaces that are not required for Protect operation until the firmware patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
