What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Update a UniFi Protect AI Key to firmware 2.2.8 or later. As of October 15, 2026, Ubiquiti Security Advisory Bulletin 070 lists AI Key firmware 2.2.6 and earlier as affected by five vulnerabilities. Updating through UniFi Protect or Site Manager, then confirming the installed version and cleared update warning, is the supported way to verify remediation.
The current secure firmware target
AI Key firmware 2.2.8 or later is the current minimum for addressing the vulnerabilities listed in Ubiquiti Security Advisory Bulletin 070, published October 14, 2026. The bulletin identifies five issues:
As an Amazon Associate I earn from qualifying purchases.
- CVE-2026-110454
- CVE-2026-110455
- CVE-2026-110456
- CVE-2026-110457
- CVE-2026-110458
The five issues have published CVSS severities ranging from 3.7 Low to 8.1 High. Bulletin 070 classifies AI Key 2.2.6 and earlier as affected and gives 2.2.8 or later as the mitigation. Therefore, a device that reports 2.2.6 has not reached the current security target, even if it was updated recently.
Why firmware 2.2.6 is no longer enough
Ubiquiti’s earlier Security Advisory Bulletin 067, published August 26, 2026, required AI Key 2.2.6 or later for CVE-2026-77557, an improper access-control vulnerability rated CVSS 9.8 Critical. The 2.2.6 release notes say that release fixed the security issues mentioned in Bulletin 067.
#1 Best Overall
Bulletin 070 supersedes that earlier minimum for current remediation. It specifically includes 2.2.6 among the affected versions, so treating 2.2.6 as the final answer leaves the later five-issue exposure unresolved.
| Ubiquiti publication | Firmware or issue covered | What it means now |
|---|---|---|
| Security Advisory Bulletin 067, August 26, 2026 | CVE-2026-77557; CVSS 9.8 Critical | Established the 2.2.6-or-later requirement for that earlier issue. |
| AI Key 2.2.6 release notes | Security issues named in Bulletin 067 | Documents the fixes included in 2.2.6. |
| Security Advisory Bulletin 070, October 14, 2026 | Five CVEs; CVSS range 3.7 Low to 8.1 High | Lists 2.2.6 and earlier as affected and sets 2.2.8 or later as the current mitigation. |
Prepare the AI Key before starting
Confirm power and adoption
The AI Key must be connected with PoE++ and adopted to UniFi Protect. Ubiquiti notes that the initial firmware update can take several minutes. Keep the device powered throughout that process and the later update reboot.
Check the Protect environment
The AI Key is managed through UniFi Protect. Ubiquiti’s compatibility information states that AI Key 2.2.6 required Protect 7.2 or newer. Keep the Protect application current before or alongside the device update so the installed firmware and management software remain compatible.
Rank #2
Choose a release channel deliberately
For a normal production update, use the Official release channel. Early Access should be selected only when your organization intentionally tests prerelease software and accepts the associated change-control implications. The security target is a firmware version, not a reason to switch channels casually.
Update through UniFi Protect or Site Manager
- Verify the physical and management prerequisites. Check that the AI Key has PoE++ power, appears as adopted in UniFi Protect, and has enough uninterrupted time to complete an update and reboot.
- Open the update controls. In Site Manager, open Update Manager. Ubiquiti also places device update controls in the settings of the associated application, so you can use the AI Key’s update entry in UniFi Protect.
- Locate the AI Key. Select the AI Key device in the update view and inspect the release channel. Leave it on Official unless your organization has an explicit Early Access testing policy.
- Start the firmware update. Use the update control shown for the AI Key. Allow the transfer, installation, and reboot to finish rather than interrupting power or network connectivity.
- Wait for the device to return. Do not remove PoE++ power while the update is running or while the AI Key is rebooting. The first update can take several minutes, according to Ubiquiti.
- Reopen the device details. After the AI Key is back in Protect, open its details and record the firmware version that the console reports. This displayed version is the key verification value.
Why routine SSH updating is the wrong path
Ubiquiti says SSH updating is not an officially supported process and may prevent the UniFi Console from functioning. Do not use SSH for a routine firmware upgrade. Ubiquiti reserves that approach for situations in which Support specifically requests it.
Verify that the security fix is actually installed
Use all of the following checks after the AI Key has rebooted:
- Check the reported firmware. In the AI Key device details, confirm the version is 2.2.8 or later. This is the threshold in Bulletin 070. A result of 2.2.6 or any earlier version does not satisfy the current mitigation.
- Check Protect compatibility. Confirm the Protect application is current enough for the installed AI Key release. Because AI Key 2.2.6 required Protect 7.2 or newer, keeping Protect current is the safer compatibility choice for 2.2.8 and later.
- Check Update Manager status. Reopen Update Manager and confirm that the AI Key’s update warning or pending-update indicator has cleared. Update Manager is Ubiquiti’s central place for viewing and managing device updates.
- Check again after any delayed reboot. If the device is temporarily absent while restarting, wait for it to return and then inspect the reported version again rather than assuming the installation completed.
Ubiquiti’s documented verification is based on the installed version and update status. The published guidance does not provide a separate checksum procedure, so do not represent a checksum comparison as an official requirement for this fix.
If the AI Key still reports 2.2.6 or earlier
Treat the remediation as incomplete. A stale version means the device remains in the affected range identified by Bulletin 070. Retry through the supported Protect or Site Manager update path, then repeat the version and Update Manager checks after the next reboot.
Troubleshoot an update that will not start or finish
1. Check connectivity, DNS, and time services
Ubiquiti’s troubleshooting sequence starts with the network prerequisites. Confirm that the console and AI Key can reach the internet, that DNS resolution works, and that UDP ports 53 and 123 are available. Port 53 is used for DNS and port 123 for network time; blocking either can interfere with update operations.
Rank #4
2. Retry from the supported UI
After correcting connectivity, return to Update Manager in Site Manager or the associated application settings and retry the update. Keep the AI Key on PoE++ and avoid interrupting the device while the retry is in progress.
3. Use the update-cache method when the normal path fails
Ubiquiti’s advanced update guidance documents a cache-based method for cases in which a normal online update does not work. Use that documented procedure rather than improvising a firmware transfer or running an unsupported SSH command. The cache method is an advanced alternative to the ordinary online UI workflow, not the first step for a healthy installation.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →4. Follow a manual firmware-link procedure only when necessary
The advanced guide also documents manual firmware links. Use the exact firmware link and instructions provided by Ubiquiti for your device and release; do not substitute a file from an unverified source. After installation, return to the normal verification checklist and confirm that the AI Key reports 2.2.8 or later.
5. Reserve recovery mode for last-resort recovery
Recovery mode is documented as a last resort. It is appropriate only after the supported update path and the documented cache or manual procedures have failed, or when the device cannot complete a normal update. Follow Ubiquiti’s recovery instructions exactly and keep the device powered during the recovery process.
6. Escalate instead of using unsupported SSH
If the device remains stuck, will not adopt, or repeatedly returns to an affected firmware version, contact Ubiquiti Support. SSH updating is not officially supported and can affect UniFi Console operation; use it only when Ubiquiti Support explicitly directs you to do so.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the AI Key does and why timely updates matter
The UniFi Protect AI Key is an edge AI appliance that processes smart detections from paired UniFi cameras. Ubiquiti states that it can process up to 1,000 smart detections per hour. It supports an unlimited number of paired cameras in principle, subject to that processing capacity.
The processing queue holds up to 200 events. When the queue is full, processing can be delayed by up to 15 minutes. Those capacity figures do not change the security requirement: a device handling a large detection workload should still be brought to 2.2.8 or later through the supported update process.
Choosing an update approach
| Approach | When to use it | Support status and trade-off |
|---|---|---|
| Online update through UniFi Protect or Site Manager | Normal installations with working internet access | Recommended UI workflow; simplest path for selecting the Official channel and confirming status in Update Manager. |
| Official release channel | Production systems that need the standard release path | Use by default for the 2.2.8-or-later security update. |
| Early Access release channel | Organizations intentionally testing Early Access firmware | Select only under an explicit testing policy; it is not required merely to remediate Bulletin 070. |
| Cached or manual update procedure | Normal UI update fails after network checks | Documented advanced alternatives; follow Ubiquiti’s exact cache or manual-link instructions. |
| Recovery mode | The supported update and advanced alternatives cannot recover the device | Last resort, not the routine upgrade path. |
| SSH update | Only when Ubiquiti Support specifically requests it | Not officially supported for routine updating and may prevent the UniFi Console from functioning. |
Final verification record
For each updated AI Key, record the date, the firmware version shown after reboot, and whether Update Manager cleared the warning. A compliant result is an AI Key reporting 2.2.8 or later, running with a current Protect application, and showing no outstanding update warning. If any of those checks fails—especially the version check—continue troubleshooting rather than treating the security fix as complete.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
