Ubiquiti has disclosed two severe vulnerabilities in its popular UniFi Network Application, including a maximum-severity path traversal flaw (CVE-2026-22557, CVSS 10.0) that allows unauthenticated remote attackers to access sensitive files and gain full administrative control over underlying systems. A second high-severity issue (CVE-2026-22558, CVSS 7.7) enables authenticated users to escalate privileges via NoSQL injection, potentially compromising network data and accounts. The flaws affect UniFi Network Application versions 10.1.85 and earlier (official), 10.2.93 and earlier (release candidate), and UniFi Express versions 9.0.114 and earlier. Security researchers n00r3 and Garett Kopcha discovered the vulnerabilities, which Ubiquiti addressed in updates released around March 18-19, 2026. Users are strongly urged to upgrade immediately to versions 10.1.89+, 10.2.97+, or equivalent firmware, and restrict exposure of management interfaces to prevent exploitation.