CVE-2025-52665Unifi Access Missing Authentication
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication.
Published Oct 30, 2025 · Updated Oct 18, 2026
Key Facts
Patch immediately- CVE-2025-52665 is a critical-severity vulnerability (CVSS 10.0 v3.1) affecting Unifi Access (Ui), UniFi Access Application.
- It is exploited in the wild, listed in Industry KEV feed since Jan 16, 2026. No public exploit code is known.
- EPSS estimates a 41% probability of exploitation in the next 30 days.
- Fixed versions are available, including Unifi Access 4.0.21.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
10.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
41%
Higher than 98.6% of all scored CVEs
Exploit maturity
Exploited (KEV)
ATLAS score
53/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Jan 16, 2026
78 days after publication
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Exploited (KEV)
Public exploit code
0
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
Description
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later.
Affected Products: UniFi Access Application (Version 3.3.22 through 3.4.31).
Mitigation: Update your UniFi Access Application to Version 4.0.21 or later.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Jan 16, 2026 | n/a | Not reported |
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Unifi AccessUi | See advisory | 4.0.21 |
| UniFi Access Application | >= 3.3.22 | n/a |
Patched Releases
Unifi Access
4.0.21
Timeline
Publicly disclosed
Oct 30, 2025
Added to Industry KEV feed
Jan 16, 2026
Last updated
Oct 18, 2026
Weakness Type
- CWE-306 Missing Authentication for Critical Function
References
FAQ
Common Questions.
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication.
Affected: Unifi Access (Ui); UniFi Access Application versions >= 3.3.22. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Jan 16, 2026.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Unifi Access 4.0.21.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2025-52665 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo