CVE-2026-21633: Vulnerability in Ubiquiti Inc UniFi Protect Application
CVE-2026-21633 is a high-severity vulnerability in Ubiquiti Inc's UniFi Protect Application version 6.1.79 and earlier. It allows an attacker on an adjacent network to gain unauthorized access to UniFi Protect Cameras by exploiting a flaw in the discovery protocol. The vulnerability requires no authentication or user interaction and impacts confidentiality, integrity, and availability of the affected devices. Exploitation could lead to full compromise of camera feeds and control, posing significant privacy and security risks. The vulnerability has a CVSS score of 8.8. Mitigation involves updating the UniFi Protect Application to version 6.2.
AI Analysis
Technical Summary
CVE-2026-21633 is a vulnerability in the UniFi Protect Application that allows an attacker on an adjacent network to exploit a discovery protocol flaw to gain unauthorized access to cameras. This flaw requires no authentication or user interaction, enabling potential full compromise of camera feeds and control. The vulnerability affects version 6.1.79 and earlier and has a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability. The issue is classified under CWE-287 (Improper Authentication).
Potential Impact
Successful exploitation allows an attacker on an adjacent network to fully compromise UniFi Protect Cameras, gaining unauthorized access to live feeds and control functions. This compromises the confidentiality, integrity, and availability of the affected devices, leading to significant privacy and security risks for users.
Mitigation Recommendations
A fix is available by updating the UniFi Protect Application to version 6.2.72 or later. Users should apply this update promptly to remediate the vulnerability. No other mitigation steps are indicated.
CVE-2026-21633: Vulnerability in Ubiquiti Inc UniFi Protect Application
Description
CVE-2026-21633 is a high-severity vulnerability in Ubiquiti Inc's UniFi Protect Application version 6.1.79 and earlier. It allows an attacker on an adjacent network to gain unauthorized access to UniFi Protect Cameras by exploiting a flaw in the discovery protocol. The vulnerability requires no authentication or user interaction and impacts confidentiality, integrity, and availability of the affected devices. Exploitation could lead to full compromise of camera feeds and control, posing significant privacy and security risks. The vulnerability has a CVSS score of 8.8. Mitigation involves updating the UniFi Protect Application to version 6.2.
CVSS v3.1
Score 8.8high
Affected software
pkg:github/ubiquiti/UniFi-Protect-ApplicationRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-21633 is a vulnerability in the UniFi Protect Application that allows an attacker on an adjacent network to exploit a discovery protocol flaw to gain unauthorized access to cameras. This flaw requires no authentication or user interaction, enabling potential full compromise of camera feeds and control. The vulnerability affects version 6.1.79 and earlier and has a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability. The issue is classified under CWE-287 (Improper Authentication).
Potential Impact
Successful exploitation allows an attacker on an adjacent network to fully compromise UniFi Protect Cameras, gaining unauthorized access to live feeds and control functions. This compromises the confidentiality, integrity, and availability of the affected devices, leading to significant privacy and security risks for users.
Mitigation Recommendations
A fix is available by updating the UniFi Protect Application to version 6.2.72 or later. Users should apply this update promptly to remediate the vulnerability. No other mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- hackerone
- Date Reserved
- 2026-01-01T15:00:02.338Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 695bec94b7d62031395509db
Added to database: 01/05/2026, 16:53:40 UTC
Last enriched: 05/26/2026, 20:26:55 UTC
Last updated: 09/10/2026, 19:36:52 UTC
Views: 829
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.