This vulnerability (CVE-2026-55115) involves a Server-Side Request Forgery (CWE-918) in the UniFi Protect Application by Ubiquiti Inc. It allows a malicious actor with network access and low privileges to perform SSRF attacks that can lead to privilege escalation on the host device. The CVSS v3.1 base score is 9.9, reflecting critical severity with network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. No remediation level or patch information is currently available from the vendor or advisory sources.

Successful exploitation could allow an attacker with limited network access and low privileges to escalate their privileges on the host device running the UniFi Protect Application. This could lead to full compromise of the device, including unauthorized access to sensitive data and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the UniFi Protect Application and monitor for suspicious activity related to SSRF attempts. Follow vendor communications closely for updates on patches or mitigations.