iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Update your UniFi Protect AI Key to firmware 2.2.8 or later. As of October 15, 2026, Ubiquiti Security Advisory Bulletin 070 lists version 2.2.6 and earlier as affected by five vulnerabilities (CVE-2026-110454 through CVE-2026-110458). The bulletin rates those issues from CVSS 3.7 Low to 8.1 High, so 2.2.6 is no longer the current security target.
Use the supported update controls in UniFi Protect or Site Manager, keep the AI Key connected to PoE++ and powered through the reboot, then verify the reported firmware version after it comes back online. The fix is complete only when the device reports 2.2.8 or a later release and the update warning has cleared.
What the AI Key firmware update fixes
The UniFi Protect AI Key is an edge appliance that processes smart detections from paired UniFi cameras. Ubiquiti rates its capacity at up to 1,000 smart detections per hour. It can be paired with an unlimited number of cameras, but the practical limit is the appliance’s processing capacity rather than a camera-count quota.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSecurity Advisory Bulletin 070, published October 14, 2026, identifies five vulnerabilities affecting AI Key firmware 2.2.6 and earlier:
#1 Best Overall
| Advisory | Affected AI Key versions | Required mitigation | Severity information |
|---|---|---|---|
| Ubiquiti Security Advisory Bulletin 070 | 2.2.6 and earlier | Firmware 2.2.8 or later | Five issues ranging from CVSS 3.7 Low to 8.1 High |
- CVE-2026-110454
- CVE-2026-110455
- CVE-2026-110456
- CVE-2026-110457
- CVE-2026-110458
The bulletin’s version threshold is the security decision point: a device still showing 2.2.6 or an older build should be treated as not remediated, even if it was updated recently or previously passed an earlier advisory check.
Why firmware 2.2.6 is not sufficient
Ubiquiti’s earlier Security Advisory Bulletin 067, dated August 26, 2026, addressed CVE-2026-77557, an improper access-control vulnerability rated CVSS 9.8 Critical. That advisory required AI Key firmware 2.2.6 or later. The 2.2.6 release notes also state that they fixed the security issues named in Bulletin 067.
Bulletin 070 supersedes that earlier minimum for current remediation. It explicitly includes 2.2.6 among the affected versions and raises the target to 2.2.8 or later. Therefore, an installation that was correctly updated for Bulletin 067 can still need another firmware update now.
Prepare the AI Key before updating
Confirm power and adoption
Connect the AI Key with PoE++ and make sure it is adopted to UniFi Protect before starting. Ubiquiti says to allow several minutes for the initial firmware update to complete. A marginal power connection or an appliance that is not fully adopted can prevent the update controls from appearing or interrupt the reboot.
Check Protect compatibility
AI Key firmware 2.2.6 required UniFi Protect 7.2 or newer. Keep the Protect application current before or alongside the AI Key update so the console can recognize the installed release and manage it correctly. If Protect itself is behind the required compatibility level, update Protect through its normal application update process first.
Rank #2
Choose the release channel deliberately
For a production installation, use the Official release channel. Choose Early Access only when your organization intentionally tests pre-release software and accepts the associated change risk. The security threshold in Bulletin 070 applies to the released firmware target; switching channels does not remove the need to verify the actual version reported by the device.
Plan for an interruption
The AI Key must reboot to complete a firmware installation. Schedule the change when a short interruption to smart-detection processing is acceptable, and do not remove PoE++ power while the update or reboot is in progress.
Recommended Free Tools
Update through the supported UniFi interface
- Open the management interface. Sign in to UniFi Protect or to Site Manager with an account that can administer the associated console.
- Open the update controls. In Site Manager, use Update Manager. Ubiquiti’s update guidance also places device updates in the settings of the associated application, so the exact screen depends on whether you are working from Site Manager or directly in Protect.
- Locate the AI Key. Select the AI Key device in the update list or device settings. Check the current version before accepting the update; record it if you need an audit trail.
- Select Official, unless Early Access is intentional. Do not change channels merely to make an update appear. If the organization does not test Early Access releases, leave the channel on Official.
- Start the firmware update. Approve the update prompt and wait. The appliance may disappear from the device list temporarily while it installs and reboots.
- Keep PoE++ connected. Do not unplug the cable, disable the supplying port, or reboot the console during installation. Ubiquiti warns that the initial firmware update can take several minutes; the same uninterrupted-power rule applies to a later security update.
- Wait for Protect to reconnect. After the reboot, allow the AI Key to return to an adopted or connected state before judging the update. Refreshing the browser does not speed the installation and can make an in-progress update look incomplete.
Routine updates should use this interface. Ubiquiti does not officially support updating AI Key firmware over SSH and warns that an SSH-based process may prevent the UniFi Console from functioning. Use SSH only if Ubiquiti Support specifically directs you to do so.
Verify that the security fix is actually installed
Do not rely only on a successful progress message. Perform all of these checks after the reboot.
1. Read the installed firmware version
Reopen the AI Key’s device details in Protect or Site Manager and read the reported firmware version. It must be 2.2.8 or later. Versions 2.2.6, 2.2.5, or any earlier version remain below Bulletin 070’s mitigation threshold.
2. Check Protect’s compatibility level
Confirm that the Protect application is current enough for the installed AI Key release. Version 2.2.6 required Protect 7.2 or newer, and maintaining a current Protect build is the safer compatibility choice for 2.2.8 and later. A device can display a newer firmware number while the application is too old to manage all of its functions reliably.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall3. Recheck Update Manager
Open Update Manager again and look for the AI Key’s update status. The advisory or update warning should be cleared after the device reports the remediated version. Update Manager is Ubiquiti’s central place to view and manage updates, so it is the appropriate location for this confirmation.
4. Confirm normal device state
Verify that the AI Key is adopted or connected and that Protect is receiving smart detections from paired cameras. A version number alone does not prove that the appliance completed its reboot and re-established its application connection.
5. Record the result
For a managed environment, record the date, the reported AI Key version, the Protect version, and the Update Manager status. This creates a simple evidence trail without inventing a checksum procedure: the reviewed Ubiquiti guidance does not publish an independent checksum-verification method for this update.
If the AI Key still shows 2.2.6 or earlier
Treat the security fix as incomplete. Do not classify the device as remediated because Bulletin 067 was previously satisfied. First retry from the supported UI path after checking connectivity and compatibility. If the update is offered but fails, follow the troubleshooting sequence below rather than switching immediately to SSH.
Rank #4
Troubleshoot an update that will not start or finish
Check Internet access
Ubiquiti’s current troubleshooting sequence starts with the console’s Internet connection. Confirm that the UniFi console can reach the Internet and that no firewall, gateway policy, or upstream outage is blocking update retrieval. A device that is adopted locally can still fail to download firmware if outbound access is restricted.
Check DNS resolution
Verify that the console can resolve the update service’s hostnames. Incorrect DNS settings, an unreachable resolver, or a filtering service can leave Update Manager showing an unavailable or stalled update even when ordinary local Protect pages load.
Check UDP ports 53 and 123
Ubiquiti specifically calls out UDP port 53 for DNS and UDP port 123 for time synchronization. Ensure that the network path permits both. DNS failure prevents the download from being located; blocked time synchronization can cause certificate or scheduling problems that look like a firmware failure.
Retry from Update Manager
After correcting network conditions, return to Update Manager, refresh the AI Key entry, and start the update again. Keep the appliance powered until the process either completes or clearly reports an error. If the console has cached a failed download, a fresh retry may be enough to recover.
Use the documented update-cache method when normal retrieval fails
Ubiquiti’s advanced update guidance documents an update-cache method for cases where the normal online path cannot deliver the firmware. This remains a supported alternative to an improvised SSH installation. Follow the exact cache procedure and firmware link supplied in Ubiquiti’s current documentation for your console and release; do not substitute a file from an unverified source.
Escalate before using recovery mode
Recovery mode is a last resort in Ubiquiti’s guidance. It is intended for an appliance that cannot complete a normal or cache-based update, not for a routine version change. Before entering recovery, capture the displayed error, current firmware, Protect version, and network conditions so Support can distinguish a download problem from a device-recovery problem.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Advanced methods and what to avoid
SSH firmware installation
SSH updating is not an officially supported process. Ubiquiti warns that it may prevent the UniFi Console from functioning, so it should be used only at Ubiquiti Support’s request. A command that appears to write firmware successfully is not a substitute for the supported update workflow or for the post-reboot version check.
Manual firmware links
The advanced guide documents manual firmware links as part of cache-based or exceptional recovery workflows. Use only the link and file specified by Ubiquiti for the intended AI Key release. Do not infer that a similarly named image, an older advisory build, or a community-hosted file satisfies Bulletin 070.
Recovery mode
Recovery mode can restore an appliance that cannot boot or update normally, but it carries more operational risk than an Update Manager retry. Keep it as the final escalation step and follow Ubiquiti’s procedure exactly. Once the device returns, repeat the complete verification checklist and confirm a version of 2.2.8 or later.
Understand processing behavior during and after the update
The AI Key has a processing queue limit of 200 events. When that queue is full, processing can be delayed by up to 15 minutes. A brief interruption during reboot is therefore different from a security failure: queued detections may take time to clear after the appliance reconnects.
After the update, watch the device long enough to distinguish normal queue drain from a persistent fault. Confirm that new detections continue to arrive, that the AI Key remains adopted, and that the queue does not remain saturated. The appliance’s published capacity is up to 1,000 smart detections per hour, but actual behavior depends on the number and activity of paired cameras.
Decision guide: which update path should you use?
| Situation | Recommended path | Reason |
|---|---|---|
| AI Key is adopted, connected to PoE++, and the update is visible | Update through Protect or Site Manager Update Manager | Supported routine workflow |
| Organization intentionally tests pre-release software | Use Early Access only under that testing policy | Channel choice is deliberate rather than a workaround |
| Normal download fails after network checks | Use the documented update-cache method | Ubiquiti documents cached and manual-link workflows for exceptional cases |
| Device cannot complete normal or cache-based recovery | Escalate to Ubiquiti Support and consider recovery mode only as a last resort | Recovery is not the ordinary update path |
| Considering an SSH command found elsewhere | Do not use it unless Ubiquiti Support directs you | SSH updating is unsupported and may affect console operation |
Final security status to record
For the current advisory state, record the AI Key as remediated only when its device details show firmware 2.2.8 or later, Protect is compatible and current, Update Manager no longer presents the relevant warning, and the appliance has returned to a normal connected state after reboot. If any of those checks fails—especially the version threshold—continue treating the device as affected by Bulletin 070 and use the supported retry or escalation path.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
