CVE-2026-22558
Published: 19 March 2026
Summary
CVE-2026-22558 is a high-severity Improper Neutralization of Special Elements in Data Query Logic (CWE-943) vulnerability in Ui (inferred from references). Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22558 is an authenticated NoSQL injection vulnerability (CWE-943) in the UniFi Network Application. Published on 2026-03-19T15:16:23.697, it carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). The flaw enables a malicious actor with authenticated network access to escalate privileges through improper handling of NoSQL queries.
An attacker requires low privileges (PR:L) and authenticated access to the network to exploit this vulnerability remotely (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation changes scope (S:C), yielding high confidentiality impact (C:H) via privilege escalation, potentially exposing sensitive data without integrity or availability disruption.
Ubiquiti's Security Advisory Bulletin 062 details mitigation and patching information at https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13104
Vulnerability details
An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to the network to escalate privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated NoSQL injection directly enables privilege escalation (T1068) with scope change and high confidentiality impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents NoSQL injection (CWE-943) by validating and sanitizing user inputs used in NoSQL queries, blocking malicious privilege escalation attempts.
Remediates the specific authenticated NoSQL injection flaw through timely identification, reporting, and patching as per Ubiquiti's Security Advisory Bulletin 062.
Limits the scope and impact of privilege escalation from low-privilege (PR:L) accounts by enforcing least privilege principles.