CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2026-55110
Medium (6.1) in ui. EPSS 0.3% chance of exploitation in the next 30 days.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
- CWE
- CWE-942
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ui:enterprise_firewall_core_firmware
- ui:enterprise_fortress_gateway_firmware
- ui:enterprise_network_video_recorder_core_firmware
- ui:enterprise_network_video_recorder_firmware
- ui:unas_2_firmware
- ui:unas_4_firmware
- ui:unas_pro_4_firmware
- ui:unas_pro_8_firmware
- ui:unas_pro_firmware
- ui:unifi_cloud_gateway_fiber_firmware
- ui:unifi_cloud_gateway_industrial_firmware
- ui:unifi_cloud_gateway_max_firmware
- ui:unifi_cloud_gateway_ultra_firmware
- ui:unifi_cloud_key_plus_firmware
- ui:unifi_cloudkey_enterprise_firmware
- ui:unifi_cloudkey_firmware
- ui:unifi_dream_machine_beast_firmware
- ui:unifi_dream_machine_pro_firmware
- ui:unifi_dream_machine_pro_max_firmware
- ui:unifi_dream_machine_special_edition_firmware
- ui:unifi_dream_router_7_firmware
- ui:unifi_dream_router_firmware
- ui:unifi_dream_wall_firmware
- ui:unifi_express_7_firmware
- ui:unifi_network_video_recorder_firmware
- ui:unifi_network_video_recorder_g2_firmware
- ui:unifi_network_video_recorder_g2_pro_firmware
- ui:unifi_network_video_recorder_instant_firmware
- ui:unifi_network_video_recorder_pro_firmware
- ui:unifi_os_server