EUVD-2026-66390
GHSA-4c82-32w7-vxc8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege UniFi OS account
-
DeliveryAccess reachable debug interface
-
ExploitSatisfy required interaction and conditions
-
ExecutionTrigger leftover active debug code
-
PersistEscalate privileges and cross security scope
-
ImpactGain full control of the device
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires an authenticated low-privilege account on the UniFi OS device (CVSS PR:L) and network access to it (AV:N), plus a user interaction (UI:R) to trigger the debug code path. Ubiquiti's own wording that it works only 'under certain conditions' indicates the flaw is not reachable in every deployment or default state - a non-default or specific runtime condition must hold - which meaningfully limits opportunistic exploitation. Limiting factors are therefore: the attacker must first obtain valid low-tier credentials, a user/interaction step must occur, and the specific triggering condition must be present; it is not an unauthenticated, zero-click flaw. |
| Impact | Signals are mixed but lean toward real priority given the deployment footprint. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H = 9.0) reflects a network-reachable, low-privilege, scope-changing flaw with total impact, but two factors temper raw severity: UI:R requires a user interaction, and the description explicitly says exploitation happens only 'under certain conditions,' which argues the real attack complexity is higher than the published AC:L - a point worth verifying against the vendor advisory. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is not a zero-day scenario. The authenticated prerequisite plus conditional triggering suggests moderate real-world exploitability rather than trivial mass exploitation, but the very wide, internet-adjacent installed base of UniFi gateways keeps this a high-value patch target. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege account on a UniFi OS appliance (for example a limited operator role on a Dream Machine or Cloud Key) reaches the device over the network and, once the required user interaction and specific conditions are met, invokes the leftover debug code path to break out of its restricted context and gain elevated privileges on the underlying host. No public exploit is identified at time of analysis, so this would currently require original research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances running the UniFi OS platform, where leftover Active Debug Code (CWE-489) lets an authenticated low-privilege actor with network access elevate their privileges on the device. The flaw is vendor-reported via Ubiquiti Security Advisory Bulletin 067 and carries a 9.0 CVSS driven by a security-scope change and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the wide device footprint makes it a notable patch priority.
RemediationAI
Patch available per vendor advisory: apply the UniFi OS updates referenced in Ubiquiti Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9) to every affected appliance - UniFi OS Server, Cloud Keys, NVR/Enterprise NVR, Enterprise NAS, Dream Machines/Routers/Wall, Express 7, Enterprise Firewall Core, Enterprise Fortress Gateway, and Cloud Gateways - and confirm the fixed build number from that bulletin since exact versions are not in this dataset. Until patched, reduce exposure by restricting who can hold the low-privilege accounts the attack requires: enforce strong, unique admin/operator credentials and remove unnecessary local users, and limit network reachability of the UniFi OS management interfaces to trusted management VLANs or VPN rather than exposing them broadly (trade-off: tighter access control can inconvenience remote administration). Because UI:R is in the vector, caution privileged users against interacting with untrusted prompts or content on the device UI. Enable automatic updates where supported so the fix deploys promptly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-489 (Active/Leftover Debug Code): a diagnostic code path intended for development but shipped in production firmware, giving an authenticated user a route to actions beyond their assigned role. The affected surface is the UniFi OS operating system underpinning Ubiquiti's network and storage appliances, confirmed by the CPE set covering unifi_os_server, cloud_keys, network_video_recorders, enterprise_network_video_recorders, enterprise_network_attached_storage, dream_machines, dream_routers, enterprise_firewall_core, enterprise_fortress_gateway, and cloud_gateways (tags also list Dream Wall, Express 7, and Network Attached Storage). Because UniFi OS runs applications in a managed/containerized environment, the CVSS scope change (S:C) indicates the debug path lets the attacker break out of their constrained security context and act with higher privilege on the underlying host.
Know when Network Attached Storage gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Network-reachable but needs a low-priv account (PR:L) and user interaction (UI:R); the vendor's 'under certain conditions' implies AC:H, and container/scope breakout with full device compromise gives S:C and C/I/A:H.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
Executive ViewAI
Ubiquiti UniFi OS devices used in network infrastructure (gateways, NVRs, storage appliances, Cloud Key) are vulnerable to privilege escalation attacks that grant full administrative control to attackers. With no patch currently available and a critical 9.0 CVSS rating, organizations relying on these devices for network operations face urgent risk to infrastructure security and business continuity. Immediate mitigation through access controls and monitoring is required while awaiting vendor remediation.
Absent vendor patch: implement network-based access controls restricting management interfaces to authorized administrative networks or VPN-only access; enforce multi-factor authentication for all administrative accounts; deploy privileged access management (PAM) for credential control and session monitoring; implement detailed logging and alerting on administrative activities; disable non-essential management protocols; perform network segmentation to isolate critical infrastructure assets; regularly audit user access privileges and administrative account usage patterns; establish incident response procedures for potential compromise detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Network Attached Storage
View allAuthentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arb
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authentica
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across th
Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CW
Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious
Exploit-DB