UniFi Play path traversal to RCE, patch now (CVE-2026-22562)

Overview

A critical security vulnerability, tracked as CVE-2026-22562, has been identified in specific UniFi Play devices. This flaw allows an attacker with network access to write arbitrary files to the system, which can be leveraged to achieve full remote code execution (RCE).

Affected Products

The vulnerability exists in the device firmware of the following products:

• UniFi Play PowerAmp: Version 1.0.35 and earlier.
• UniFi Play Audio Port: Version 1.0.24 and earlier.

Technical Details

The vulnerability is a path traversal flaw. In simple terms, it fails to properly validate file paths in network requests. A malicious actor on the same network as the UniFi Play device can exploit this weakness to write files to unintended locations on the device’s filesystem. By writing a malicious file, such as a script, the attacker can then trigger its execution, effectively taking control of the device. The attack requires no authentication (privileges) and no user interaction, making it highly severe.

Impact

If successfully exploited, this vulnerability grants an attacker complete control over the affected UniFi Play device. From there, an attacker could disrupt audio services, use the device as a foothold to attack other devices on the local network, or potentially exfiltrate data. Given the CVSS v3.1 base score of 9.8 (CRITICAL), this represents a significant risk to network security.

Remediation and Mitigation

The only complete remediation is to update the device firmware to a patched version.

• UniFi Play PowerAmp: Update to version 1.0.38 or later.
• UniFi Play Audio Port: Update to version 1.1.9 or later.

These updates should be applied immediately. As a temporary mitigation, if updating is not immediately possible, network segmentation can be used to isolate UniFi Play devices from untrusted networks and user devices to limit the potential attack surface.

Security Insight

This vulnerability highlights the persistent risk of path traversal flaws in embedded and IoT device firmware, a class of bug often stemming from simpler coding errors. Similar incidents in other network-attached storage and appliance products have shown that such flaws can provide a direct route from a network presence to full system compromise, underscoring the critical need for robust input validation in all network-facing services. For the latest on emerging threats, monitor our security news feed.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs