{"api_version":"1","generated_at":"2026-10-21T22:12:14+00:00","cve":"CVE-2026-110456","urls":{"html":"https://cve.report/CVE-2026-110456","api":"https://cve.report/api/cve/CVE-2026-110456.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-110456","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-110456"},"summary":{"title":"CVE-2026-110456","description":"A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.","state":"PUBLISHED","assigner":"Ubiquiti","published_at":"2026-10-14 05:16:43","updated_at":"2026-10-15 20:38:04"},"problem_types":["CWE-284","CWE-284 CWE-284 Improper Access Control"],"metrics":[{"version":"3.1","source":"fe490ce8-0395-4072-90d8-2707e1bdf984","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-070-070/e7ffc9fa-9129-4a90-b5e3-d597c5ee7a73","name":"https://community.ui.com/releases/Security-Advisory-Bulletin-070-070/e7ffc9fa-9129-4a90-b5e3-d597c5ee7a73","refsource":"fe490ce8-0395-4072-90d8-2707e1bdf984","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110456","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110456","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Ubiquiti Inc","product":"UniFi Protect AI Key","version":"affected 2.2.8 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"110456","cve":"CVE-2026-110456","epss":"0.002620000","percentile":"0.167910000","score_date":"2026-10-15","updated_at":"2026-10-16 00:06:12"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-110456","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T17:57:04.408362Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-14T17:57:30.697Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"UniFi Protect AI Key","vendor":"Ubiquiti Inc","versions":[{"lessThan":"2.2.8","status":"affected","version":"0","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device."}],"value":"A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-14T05:06:56.170Z","orgId":"fe490ce8-0395-4072-90d8-2707e1bdf984","shortName":"Ubiquiti"},"references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-070-070/e7ffc9fa-9129-4a90-b5e3-d597c5ee7a73"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"fe490ce8-0395-4072-90d8-2707e1bdf984","assignerShortName":"Ubiquiti","cveId":"CVE-2026-110456","datePublished":"2026-10-14T05:06:56.170Z","dateReserved":"2026-10-14T04:16:43.266Z","dateUpdated":"2026-10-14T17:57:30.697Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-14 05:16:43","lastModifiedDate":"2026-10-15 20:38:04","problem_types":["CWE-284","CWE-284 CWE-284 Improper Access Control"],"metrics":{"cvssMetricV31":[{"source":"fe490ce8-0395-4072-90d8-2707e1bdf984","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T17:57:04.408362Z","id":"CVE-2026-110456","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"110456","Ordinal":"1","Title":"CVE-2026-110456","CVE":"CVE-2026-110456","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"110456","Ordinal":"1","NoteData":"A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.","Type":"Description","Title":"CVE-2026-110456"}]}}}