UniFi OS CVE-2026-33000

Exploitation requires the attacker to already hold a high-privilege (administrator) account on the targeted UniFi OS device and to have network reachability to its management interface - typically the HTTPS web UI on the LAN, management VLAN, or any remote-access path the operator has exposed (UniFi Site Manager, port-forwarded admin port, or VPN-reachable interface). No user interaction by another party is needed (UI:N) and attack complexity is low once those prerequisites are met. Limiting factors are significant: the PR:H requirement excludes anonymous internet attackers, the CPE scopes the bug to UniFi OS Server rather than every UniFi product, and deployments that segment the management interface away from user networks further reduce reachable population.

Signals are mixed and require careful interpretation. The 9.1 CVSS reflects network attack vector, low complexity, no user interaction, and full CIA impact with scope change, but the PR:H requirement means an attacker must already hold administrator-level credentials on UniFi OS - substantially limiting the realistic exploit population to insiders, compromised admin accounts, or post-authentication pivots from another flaw. EPSS data was not provided in the input, and the CVE is not listed in CISA KEV; no public proof-of-concept was identified. The realistic priority is moderate-to-high for organizations exposing UniFi OS management interfaces to broad networks or sharing admin credentials, but lower for tightly segmented deployments where admin access is already a trust boundary. Note also that the description says 'UniFi OS devices' while the CPE names only 'unifi_os_server' - verify with the Ubiquiti advisory which exact hardware models (Dream Machine, UDM Pro, Cloud Key, etc.) are in scope.

An attacker who has obtained UniFi OS administrator credentials - for example via phishing a network engineer, reusing a leaked password, or pivoting from a separately compromised host with cached session cookies - authenticates to the UniFi OS web interface and submits a crafted value to the vulnerable administrative endpoint, embedding shell metacharacters that escape the intended argument and execute attacker-chosen commands on the underlying device. Because the scope changes, the resulting shell runs at the UniFi service privilege level, enabling the attacker to read site configuration, alter firewall and VPN rules, capture traffic, or establish persistence on the gateway itself. No public exploit identified at time of analysis, so an attacker would currently need to develop the injection payload from advisory hints.