EUVD-2026-41396
GHSA-8jvx-73vq-fvch
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Reachable over the network with a low-privileged account (AV:N/PR:L); the vendor's 'certain conditions' caveat justifies AC:H, and host takeover gives total C:H/I:H/A:H.
Primary rating from Vendor (hackerone).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device.
AnalysisAI
Privilege escalation in UniFi OS running the UniFi Protect Application (versions below 5.1.19) allows a network-adjacent, low-privileged attacker to gain control of the underlying host device via improper access control. Affected hardware spans Ubiquiti's Dream Machines, Dream Wall, Dream Routers, Cloud Keys, Cloud Gateways, and Network/Enterprise Video Recorders. No public exploit identified at time of analysis; EPSS is low (0.19%) and CISA SSVC records no known exploitation, but the total technical impact and 8.8 CVSS make it a meaningful patch priority.
More in Dream Machines
View allAuthentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Unauthorized configuration changes on Ubiquiti UniFi OS gateway devices (Dream Machines, Dream Routers, Cloud Gateways,
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances runni
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arb
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authentica
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across th
Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CW
Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today