UniFi OS CVE-2026-48610

Requires the attacker to have network reachability to a vulnerable UniFi OS gateway (UDM/UDR/UDW/EFG/UCG/Express family) AND for that gateway to be running 'certain network configurations' as stated by Ubiquiti - the specific triggering configuration is not disclosed in the advisory text supplied, which is itself a limiting factor and a data gap. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N), but the CVSS AC:H rating reflects that the vulnerable configuration is not the default and/or that the attacker must perform non-trivial preparation or condition-matching to succeed. Exploitation is bounded to attackers with layer-3 (or, depending on the service, layer-2) reach to the gateway; appliances whose management/control-plane services are confined to a trusted, segmented admin VLAN are materially harder to reach.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yields 8.1 (High) - full impact with no authentication required, but AC:H signals that successful exploitation depends on a non-default condition (the description's 'under certain network configurations'). EPSS and KEV data were not provided, and no public exploit is identified, so the empirical likelihood of mass exploitation today is unclear. The realistic risk is meaningful for organizations exposing UniFi management interfaces beyond a trusted LAN segment or running the specific vulnerable topology, but lower for properly segmented deployments; the vendor's silence on which configuration triggers the flaw is itself a key gap defenders should pressure for. Treat this as a high-priority patch for any internet-or-guest-adjacent UniFi gateway, and a medium-priority patch for hardened, isolated management LANs.

An attacker who has obtained a foothold on a network segment that can reach a vulnerable UniFi gateway - for example, via a compromised guest-VLAN device, a rogue IoT endpoint, or a malicious insider on the LAN - sends crafted traffic to the device's management or control-plane service and, because access control is improperly enforced, applies unauthorized configuration changes (e.g., disabling firewall rules, adding port forwards, or pushing rogue settings) without ever authenticating. No public exploit is identified at time of analysis, and the AC:H rating implies the attacker must first identify or induce the specific vulnerable network configuration before the request succeeds.