CVE-2026-110456 Overview
CVE-2026-110456 is an Improper Access Control vulnerability [CWE-284] affecting the UniFi Protect AI Key device from Ubiquiti. A network-adjacent attacker can leverage the flaw under certain conditions to access internal resources through the device. The weakness exposes information that would otherwise remain restricted to authorized users on protected network segments.
The vulnerability requires neither authentication nor user interaction and is exploitable over the network. The scope of impact is limited to confidentiality, with no direct effect on integrity or availability of the target. Ubiquiti disclosed the issue in Security Advisory Bulletin 070.
Critical Impact
An unauthenticated attacker on the network can pivot through the UniFi Protect AI Key to reach internal resources that should not be reachable from that network position.
Affected Products
- Ubiquiti UniFi Protect AI Key
- Refer to Ubiquiti Security Advisory Bulletin 070 for fixed firmware versions
Discovery Timeline
- 2026-10-14 - CVE-2026-110456 published to the National Vulnerability Database (NVD)
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-110456
Vulnerability Analysis
The UniFi Protect AI Key is a dedicated hardware controller that runs the UniFi Protect application and processes AI-based video analytics. CVE-2026-110456 arises from insufficient enforcement of access control boundaries on the device. A request originating from the network can reach code paths or interfaces that should be restricted.
As a result, the device acts as an unintended gateway. An attacker positioned on the same network can direct requests through the AI Key to reach internal resources behind it. The flaw does not permit modification of data or disruption of service, but it does break the segmentation assumptions that administrators rely on.
Root Cause
The root cause is an Improper Access Control weakness [CWE-284] in the UniFi Protect AI Key. Authorization checks on specific interfaces fail to validate the requester's privileges or network context. Ubiquiti's advisory references the affected component but does not publish the exact code path at this time.
Attack Vector
Exploitation requires network access to the UniFi Protect AI Key. The attacker sends crafted requests to the device over the network with low complexity and no credentials. The device then processes or relays the request in a way that exposes internal resources to the attacker. See the Ubiquiti Security Advisory Bulletin 070 for product-specific detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-110456
Indicators of Compromise
- Unexpected inbound connections to the UniFi Protect AI Key from untrusted VLANs or user network segments.
- Outbound traffic from the AI Key to internal hosts that are not part of the UniFi Protect ecosystem (NVR, cameras, update servers).
- HTTP or API requests to the device from client IP ranges that do not match administrator workstations.
Detection Strategies
- Baseline the normal traffic patterns of the UniFi Protect AI Key and alert on deviations in destination hosts, ports, or request volume.
- Review device logs for requests to administrative endpoints that originate from non-management subnets.
- Correlate firewall and switch flow data to identify traffic that transits the AI Key rather than terminating on it.
Monitoring Recommendations
- Forward UniFi Protect and network flow telemetry to a centralized SIEM or data lake for cross-source correlation.
- Monitor for new or unusual authentication attempts and session establishment on the AI Key management interface.
- Track firmware version and configuration drift on all UniFi Protect devices to confirm patch status.
How to Mitigate CVE-2026-110456
Immediate Actions Required
- Apply the firmware update published in Ubiquiti Security Advisory Bulletin 070 to all UniFi Protect AI Key devices.
- Restrict management access to the AI Key to a dedicated administrative VLAN protected by firewall rules.
- Audit recent access logs on the device for requests from unexpected source addresses.
Patch Information
Ubiquiti addressed the Improper Access Control weakness in the UniFi Protect AI Key firmware referenced in Security Advisory Bulletin 070. Administrators should consult the advisory for the specific fixed firmware version applicable to their deployment and update through the UniFi Protect application or device management console.
Workarounds
- Place the UniFi Protect AI Key on an isolated network segment that is unreachable from general user networks.
- Enforce firewall rules that permit only required ports and known management hosts to communicate with the device.
- Disable or block external exposure of the AI Key until the firmware update is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
