Two Ubiquiti-authored CVE records published on 14 October 2026 disclose High-severity vulnerabilities in UniFi Protect AI Key. If your business already uses this device, check its firmware version: both records mark versions below 2.2.8 as affected.
AI Key is a separate edge-AI appliance that processes detection events from paired UniFi cameras. The official Ubiquiti FAQ describes features including natural-language search and alerts. The disclosed flaws concern AI Key specifically; these records do not establish that all UniFi cameras or routers are affected.
What was disclosed
- CVE-2026-110455: an input-validation flaw can allow command injection on the device when an attacker has network access and additional conditions are met. Ubiquiti assigns a CVSS 3.1 score of 8.1 and rates attack complexity High.
- CVE-2026-110459: an access-control flaw can let an attacker with network access obtain information, make unauthorised changes or disrupt the device. Ubiquiti assigns a CVSS 3.1 score of 8.6.
Both scores fall in the High category. Exploitation in real-world attacks has not been established. The records’ disclosure date does not establish when firmware 2.2.8 was released.
What owners should do
Our practical takeaway: ask your existing administrator or installer to confirm that the appliance is AI Key, record its firmware version and compare it with the below-2.2.8 affected boundary. For an affected device, agree an update following the manufacturer’s current guidance, then request confirmation of the resulting version and normal system operation. The responsible specialist should check the release channel and compatibility requirements before updating.
Read also: connected-device maintenance questions prompted by Anthropic’s research. That is a separate study in controlled conditions and does not assess AI Key.
Prepared by the NADALI editorial team using AI
Sources checked on 14 October 2026. CVE records published on 14 October 2026.
