UniFi OS CVE-2026-47368

Exploitation requires network reachability to the UniFi OS management/web service on an affected device or UniFi OS Server instance - the description specifies 'access to the network', and the CVSS vector confirms AV:N/PR:N/UI:N, so no authentication, user interaction, or special configuration is needed against a default-exposed management interface. The practical limiting factor is administrative exposure of that management plane: in many Ubiquiti deployments the UniFi OS UI is reachable only from the LAN or a management VLAN, so an attacker must first gain a foothold on that segment (wired LAN access, an authorized Wi-Fi SSID, or a compromised internal host) unless the operator has deliberately exposed the management UI to the WAN.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) describes a high-severity, easily reachable, unauthenticated read-only flaw whose impact extends beyond the vulnerable component (S:C, C:H). EPSS data was not supplied, so a quantitative exploitation probability cannot be cited. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this should be treated as a high-priority remediation item rather than an emergency in-the-wild incident. The risk is amplified because the affected product family is broadly deployed at network perimeters and frequently exposed to LAN - and in some deployments, WAN - management interfaces, so a successful traversal could leak credentials, configuration backups, or session material from gateway devices. The description's phrase 'access to the network' is consistent with AV:N but does not clarify whether the management plane is normally exposed beyond the LAN; defenders should verify exposure of UniFi management ports in their own environment.

An attacker positioned on the same network as a UniFi gateway (for example, a guest Wi-Fi client, a compromised IoT device on the LAN, or - where the management interface is internet-exposed - any remote host) sends a crafted HTTP/HTTPS request to a vulnerable UniFi OS endpoint with a path parameter containing '../' sequences. The traversal escapes the intended directory and returns the contents of sensitive files such as configuration backups, credential stores, or session/token material. No public exploit identified at time of analysis, but the low attack complexity and lack of required authentication make weaponization straightforward once the vulnerable endpoint and parameter are identified.