UID Enterprise Agent CVE-2026-47367

Attacker must have network reachability to the UID Enterprise Agent service and a valid low-privilege account on the agent (PR:L per CVSS), but does not need administrative rights or any user interaction (UI:N). No special non-default configuration is called out in the description - any deployment of UID Enterprise Agent exposing its service to holders of low-privilege credentials is exploitable. Exploitation is limited by the requirement that the attacker first obtain such a low-privileged credential and by any network segmentation restricting who can reach the agent.

All signals point to high real-world risk: CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H scores 9.9, indicating network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with cross-scope full-impact consequences. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so EPSS-style mass-exploitation pressure is not yet evidenced. The PR:L requirement is the main mitigating factor - any low-privileged account or low-trust network role that can reach the agent is sufficient, which in enterprise identity-agent deployments is a low bar. EPSS score was not provided in the input, so probabilistic exploitation likelihood cannot be quantified.

An attacker who has obtained a low-privileged account on the UID Enterprise Agent - for example via a phished helpdesk credential or a reused tenant identity - connects to the agent over the network and submits a crafted request containing shell metacharacters in a field that the agent passes unsanitized into an OS command. The agent executes the injected command on the host with its own privileges, enabling the attacker to read configuration, pivot into the Ubiquiti management plane, or stage further tools. No public exploit identified at time of analysis, but the low complexity makes weaponization straightforward once the vulnerable parameter is known.