CVE-2026-54400: exploitation status and patch state

CVE-2026-54400 · CVSS 9.1 CRITICAL · EPSS 1%

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.

Is CVE-2026-54400 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 1%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2026-54400

• ShareFile Shutdown Signals More Than Maintenance (2026-07-13)
• Partial UniFi Patching Leaves the Stack Exposed (2026-07-09)

Primary sources

• NVD record

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-12.