CVE-2026-22563: UniFi Play Command Injection via Improper Input Validation
CVE-2026-22563 is a group of Improper Input Validation (CWE-20) weaknesses in UniFi Play PowerAmp and UniFi Play Audio Port that may allow command injection by an actor with access to the UniFi Play network. The record reports a CVSS 3.1 base score of 9.8 (critical) and gives fixed versions of 1.0.38 for PowerAmp and 1.1.9 for Audio Port. No KEV listing or confirmed exploitation appears in the sources consulted.
Overview
The record describes a series of Improper Input Validation weaknesses (CWE-20) in the UniFi Play product line that could allow command injection by a malicious actor with access to the UniFi Play network. The vendor advisory referenced in the record is the primary source for the affected and fixed versions.
Impact
- The description names command injection as the possible outcome of the weaknesses.
- The CVSS 3.1 vector in the record reports high impact values for confidentiality, integrity and availability.
- The record lists the attack vector as network-reachable with low complexity and no privileges or user interaction required.
Affected products and versions
- UniFi Play PowerAmp: version 1.0.35 and earlier.
- UniFi Play Audio Port: version 1.0.24 and earlier.
The structured affected and fixes fields in the record are empty, so the version ranges above come only from the description text.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed active exploitation appears in the sources consulted. The EPSS probability in the record is 0.01051 with a percentile of 0.63397.
Remediation and mitigation
- Update UniFi Play PowerAmp to version 1.0.38 or later.
- Update UniFi Play Audio Port to version 1.1.9 or later.
- Restrict access to the UniFi Play network to trusted users and devices until updates are applied.
- Review the vendor advisory for any additional instructions.
Detection guidance
- Inventory UniFi Play PowerAmp and Audio Port devices and record their current versions.
- Review network access logs and device logs for unexpected administrative activity or unusual configuration changes.
- Monitor for devices that remain on versions below the fixed releases.
Limitations of the available information
The record does not include technical details of the weakness, the affected component or the exact input path. The title field is empty in the record, and the NVD source status is marked as Deferred. The EPSS date in the record is later than the publication date and should be verified against the source.
Frequently asked questions
Which UniFi Play versions are affected by CVE-2026-22563?
The record lists UniFi Play PowerAmp version 1.0.35 and earlier and UniFi Play Audio Port version 1.0.24 and earlier as affected.
What versions fix this issue?
The record gives UniFi Play PowerAmp 1.0.38 or later and UniFi Play Audio Port 1.1.9 or later as the updated versions.
Is this CVE known to be actively exploited?
The CVE is not listed in the CISA KEV catalog in the record, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.