What is the CVSS score of CVE-2026-47370?

CVE-2026-47370 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-47370?

Within 24 hours: Inventory all affected devices per Ubiquiti Security Advisory 065 (UDM, UDM Pro/SE/Max/Beast, UDR, UDW, UCG, UNVR, UNAS), disable remote administrative access from untrusted network segments, implement network segmentation isolating devices to a dedicated admin VLAN. Within 7 days: Enable administrative access logging and network monitoring for anomalous command execution, enforce multi-factor authentication on all management accounts, register for Ubiquiti security updates. Within 30 days: Evaluate patch release from Ubiquiti; upon availability, plan controlled staged deployment; if no patch released within 90 days, evaluate device replacement or extended isolation strategy.

Ubiquiti UniFi OS CVE-2026-47370

Q: Which versions of Ubiquiti UniFi OS are affected by CVE-2026-47370?

Ubiquiti UniFi OS devices (UDM, UDM Pro, controllers, NVRs, NAS appliances) contain a critical authenticated command injection vulnerability (CVSS 9.9) enabling low-privileged local users to execute…. A patch is available.

EUVD-2026-36384 CRITICAL

Improper Input Validation (CWE-20)

2026-06-12 hackerone

GHSA-m7hq-4j28-748g

Command Injection Express Udm Udr Ubiquiti Unifi Os Server Udm Pro Udm Se Udm Pro Max Udm Beast Efg Udw Udr7 Udr 5G Express 7 Unvr Unvr Pro Unvr Instant Unvr G2 Unvr G2 Pro Envr Envr Core Unas 2 Unas 4 Unas Pro Unas Pro 4 Unas Pro 8 Uckp Uck Uck Enterprise Ucg Ultra Ucg Max Ucg Fiber Ucg Industrial Ubiquiti Inc

9.9

CVSS 3.1 · Vendor: hackerone

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach UniFi OS management interface
Delivery

Authenticate as low-privileged operator
Exploit

Submit crafted input to vulnerable endpoint
Execution

Shell metacharacters bypass input validation
Persist

Command executes on UniFi OS device
Impact

Pivot to subordinate services and network

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Attacker must have network reachability to the UniFi OS management plane (UI/API on the affected console, server, NVR, NAS, Cloud Key, or Cloud Gateway) and must hold valid low-privileged credentials on that UniFi instance (PR:L) - exploitation is not possible fully unauthenticated from the internet against a default-locked-down deployment. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once the precondition of a low-priv account plus network reach is met, exploitation is reliable; deployments that expose the controller UI to the internet or that hand out many operator/site-manager accounts to third parties are materially more at risk than isolated home deployments where only the owner has credentials.
Impact	Signals are largely aligned toward high priority: CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with scope change and total impact on the device. However, exploitation is not strictly unauthenticated - PR:L means an attacker must hold a valid low-privileged UniFi account or session, which materially limits internet-wide mass exploitation in well-segmented deployments where the controller UI is not exposed. EPSS and KEV data were not provided in the input, and no public POC is referenced, so this currently reads as a high-severity flaw with credible exploitability but no confirmed in-the-wild activity; organizations exposing UniFi management interfaces to untrusted networks or with many guest/operator accounts should treat it as urgent.
Exploit ScenarioDerived	An attacker who has obtained or been granted a low-privileged UniFi operator account (for example a site viewer, guest WiFi manager, or contractor login) reaches the UniFi OS management interface on the LAN, VPN, or an exposed remote-access endpoint and submits a crafted parameter to an API or settings field that is passed unsanitized into a shell invocation. Shell metacharacters in the payload break out of the intended command, executing arbitrary code as the management service account on the UniFi OS device and, due to scope change, pivoting to control subordinate services such as routing, firewall rules, or NVR storage.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 12, 2026

Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitrary OS commands on UniFi gateways, controllers, NVRs, and NAS devices, with a CVSS 9.9 score reflecting scope change and full CIA impact. The vulnerability affects a broad device family including UDM, UDM Pro/SE/Max/Beast, UDR, UDW, UCG, UNVR, and UNAS lines per Ubiquiti Security Advisory Bulletin 065. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

RemediationAI

Patch available per vendor advisory: update each affected UniFi OS console, server, NVR, NAS, and Cloud Gateway/Cloud Key device to the fixed UniFi OS firmware listed in Ubiquiti Security Advisory Bulletin 065 at https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a; exact patched version numbers should be taken from that advisory. Until devices are upgraded, restrict the UniFi OS management UI and APIs to trusted management VLANs or VPN-only access, disable any internet-exposed remote-access/port-forwarding to the controller (port 443/8443), audit and remove unnecessary low-privileged local accounts, rotate credentials for any account that may have been shared with untrusted operators, and enable MFA on Ubiquiti SSO - noting that the trade-off of locking down the management plane is loss of casual remote administration via the public UI.

Affected VersionsENISA

UniFi OS Server 0 <5.1.15

UNAS-Pro-8 0 <5.1.16

UCG-Fiber 0 <5.1.15

UDR-5G 0 <5.1.15

UCKP 0 <5.1.15

UCG-Ultra 0 <5.1.15

UCG-Industrial 0 <5.1.15

UNVR 0 <5.1.15

UDR7 0 <5.1.15

UNVR-G2 0 <5.1.15

UNAS-2 0 <5.1.16

UDW 0 <5.1.15

UNVR-Instant 0 <5.1.15

Express 7 0 <5.1.15

express 0 <4.0.15

UDM-SE 0 <5.1.15

EFG 0 <5.1.15

UDM-Pro-Max 0 <5.1.15

UNAS-4 0 <5.1.16

ENVR 0 <5.1.15

UNAS-Pro 0 <5.1.16

UDM-Beast 0 <5.1.15

UCK 0 <5.1.15

UDM 0 <5.1.15

UDM-Pro 0 <5.1.15

UCK-Enterprise 0 <5.1.15

ENVR-Core 0 <5.1.15

udr 0 <5.1.15

UCG-Max 0 <5.1.15

UNVR-G2-Pro 0 <5.1.15

UNVR-Pro 0 <5.1.15

UNAS-Pro-4 0 <5.1.16

Affected Packages

euvd efg fix: 5.1.15

euvd envr fix: 5.1.15

euvd envr_core fix: 5.1.15

euvd express fix: 4.0.15

euvd express_7 fix: 5.1.15

euvd ucg_fiber fix: 5.1.15

euvd ucg_industrial fix: 5.1.15

euvd ucg_max fix: 5.1.15

euvd ucg_ultra fix: 5.1.15

euvd uck fix: 5.1.15

euvd uck_enterprise fix: 5.1.15

euvd uckp fix: 5.1.15

euvd udm fix: 5.1.15

euvd udm_beast fix: 5.1.15

euvd udm_pro fix: 5.1.15

euvd udm_pro_max fix: 5.1.15

euvd udm_se fix: 5.1.15

euvd udr fix: 5.1.15

euvd udr7 fix: 5.1.15

euvd udr_5g fix: 5.1.15

euvd udw fix: 5.1.15

euvd unas_2 fix: 5.1.16

euvd unas_4 fix: 5.1.16

euvd unas_pro fix: 5.1.16

euvd unas_pro_4 fix: 5.1.16

euvd unas_pro_8 fix: 5.1.16

euvd unifi_os_server fix: 5.1.15

euvd unvr fix: 5.1.15

euvd unvr_g2 fix: 5.1.15

euvd unvr_g2_pro fix: 5.1.15

euvd unvr_instant fix: 5.1.15

euvd unvr_pro fix: 5.1.15

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 32 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

UniFi OS is the Linux-based operating system that powers Ubiquiti's gateway, controller, NVR, and NAS appliances; it exposes a unified management web UI and REST APIs that proxy operator-supplied parameters to underlying system tooling. The root cause is CWE-20 (Improper Input Validation): user-controlled input received over the management plane is not adequately sanitized before being incorporated into a command invocation, allowing shell metacharacters or argument injection to break out into the underlying shell. Because UniFi OS consoles host management daemons that frequently run with elevated privileges and bridge to subordinate UniFi network and protect services, a successful injection on the OS layer can pivot beyond the immediate process - consistent with the CVSS Scope:Changed designation.

Know when Express gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (hackerone) PRIMARY 9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI 9.9 CRITICAL

Management plane is network-reachable (AV:N), exploitation is reliable once authenticated (AC:L), a low-privileged UniFi account is required (PR:L), no user interaction, and command execution on UniFi OS pivots to subordinate services (S:C) with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 12, 2026 - 05:01 EUVD

DescriptionCVE.org

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.

Articles & Coverage 2

News 4 New Ubiquiti Vulnerabilities - 2 Critical, 2 High Severity Jun 13, 2026 News Critical Command Injection in Ubiquiti UniFi OS - CVE-2026-47370 Jun 12, 2026

Executive ViewAI

Why It Matters

Ubiquiti UniFi OS devices (UDM, UDM Pro, controllers, NVRs, NAS appliances) contain a critical authenticated command injection vulnerability (CVSS 9.9) enabling low-privileged local users to execute arbitrary OS commands with full system impact, compromising network access control, video surveillance, and infrastructure management. No vendor patch is currently available, requiring immediate compensating controls to isolate and harden these devices. Organizations with UniFi deployments face direct risk to network security posture until remediation is possible.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict UniFi device management access to dedicated administrative VLAN with strict firewall rules; (2) Enforce multi-factor authentication on all administrative accounts; (3) Implement network detection for suspicious command execution patterns; (4) Disable unnecessary management protocols and services; (5) Maintain offline configuration backups; (6) Document expedited patch deployment procedure for vendor release; (7) Monitor Ubiquiti advisory channels for patch status and timeline.

Threat Intelligence Overview

EPSS Score

0.2%

Top 57% exploitable

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.