UniFi OS EUVD-2026-36383

Attacker must have network reachability to the UniFi OS management interface (web UI or API) of an affected device - UDM family, UCG family, UDR, UNVR, UNAS, UCK, Express, EFG, UDW, or a UniFi OS Server instance - AND must hold valid credentials for a low-privileged UniFi account (PR:L), such as a site operator, read-only admin, or limited tenant role. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once those two preconditions are met exploitation is straightforward. Exploitation is LIMITED by the requirement for an existing authenticated session, so deployments that expose the UniFi OS management plane only to a trusted admin VLAN, restrict console access via SSO/MFA, and avoid provisioning low-tier accounts to untrusted parties materially reduce realistic risk; conversely, MSP/multi-tenant deployments and any device with the management interface reachable from the WAN or guest VLAN are at materially higher risk.

Signals are mixed but lean toward elevated risk. CVSS 3.1 of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates network-reachable, low-complexity, low-privilege exploitation with full CIA impact and scope change - the hallmark of a serious privilege-escalation primitive. However, PR:L means the attacker must already hold some authenticated foothold (any low-privileged UniFi user/operator account), which constrains opportunistic mass exploitation against properly segmented management planes. No EPSS score, KEV listing, or public POC was supplied, and the only reference is the vendor's Security Advisory Bulletin 065 - suggesting a coordinated disclosure rather than active in-the-wild abuse. Real-world priority is high for organizations exposing UniFi OS management interfaces beyond a trusted admin VLAN, and moderate where management access is already tightly restricted; the absence of POC or KEV data should not be read as safety, since management-plane bugs on networking gear are routinely weaponized after disclosure.

A contractor or branch-office operator with a low-tier UniFi role (e.g., site viewer or limited admin) authenticates to the UniFi OS web/API interface and submits a crafted request to an endpoint that fails to validate input, causing the privileged backend service to perform an action under elevated authority and granting the attacker super-admin control over the gateway. From there the attacker pivots: rewriting firewall and VLAN rules, mirroring traffic, planting persistence on the gateway/NVR, and using the device as a launchpad into the internal network. No public exploit identified at time of analysis, but the low complexity and network vector make weaponization straightforward once a researcher publishes details.