EUVD-2026-66364Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable command injection with low complexity and no interaction gives full host compromise beyond the app boundary, justifying PR:N, AC:L and S:C with C/I/A:H.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.
Articles & Coverage 1
AnalysisAI
Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrary OS commands on the underlying host device, per the CVSS:3.1/AV:N/PR:N/UI:N vector and CWE-20 improper input validation root cause. The maximal 10.0 score reflects full confidentiality, integrity, and availability compromise with a scope change (S:C), meaning code executes on the host beyond the application boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker requires network reachability to the UniFi Protect application interface - the description specifies 'a malicious actor with access to the network,' which at minimum means LAN/adjacent access and potentially internet access if the Protect service is exposed via remote access or port-forwarding. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-tier priority, not an inflated high-CVSS artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the UniFi Protect application over the network sends a crafted request containing shell metacharacters in an improperly validated input field, causing the injected command to execute on the host appliance's operating system. With no authentication or user interaction required (PR:N/UI:N) and low complexity, the attacker gains host-level command execution and can pivot to the surveillance data, tamper with recordings, or use the appliance as a foothold. … |
| Remediation | Patch available per vendor advisory: upgrade the UniFi Protect Application to the fixed release identified in Ubiquiti Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9); an exact fixed version number was not provided in the input, so confirm it directly from that bulletin before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately isolate all Ubiquiti UniFi Protect NVR devices from untrusted networks by implementing firewall rules that restrict access to trusted administrative networks only and disabling remote management capabilities; simultaneously inventory all UniFi Protect deployments to identify which systems face network exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Unifi Protect Application
View allCommand injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary ope
Privilege escalation via Server-Side Request Forgery in Ubiquiti's UniFi Protect Application allows a low-privileged, ne
Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged c
Authentication bypass in Ubiquiti's UniFi Protect Application (versions before 7.1.83) allows a network-adjacent attacke
Privilege escalation in Ubiquiti's UniFi Protect Application is possible through an authenticated SQL injection (CWE-89)
Authentication bypass in Ubiquiti UniFi Protect Application lets a network-adjacent attacker reach certain API endpoints
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacke
Same weakness CWE-20 – Improper Input Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today