EUVD-2026-36383
GHSA-h6vq-x5fv-h7q3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Management interface is network-reachable (AV:N), exploitation is straightforward (AC:L), a low-privileged UniFi account is required (PR:L), and escalation to full device admin crosses a security boundary (S:C, C/I/A:H).
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
Articles & Coverage 2
AnalysisAI
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on affected UniFi OS devices and instances due to improper input validation (CWE-20). The CVSS 9.9 score reflects a scope-changing impact spanning UniFi Dream Machine, UniFi Express, UDR, UCG, UNVR, UNAS, and other UniFi OS Server platforms. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Technical ContextAI
UniFi OS is Ubiquiti's unified management platform that runs on Dream Machine (UDM/UDM Pro/UDM SE/UDM Pro Max/UDM Beast), Cloud Gateway (UCG Ultra/Max/Fiber/Industrial), Dream Router (UDR/UDR7/UDR 5G), Network Video Recorders (UNVR family, ENVR), NAS appliances (UNAS 2/4/Pro family), Cloud Keys (UCK/UCKP/UCK Enterprise), Express gateways, EFG, and the standalone UniFi OS Server. The root cause is CWE-20 Improper Input Validation, meaning untrusted input reaches a privileged operation without adequate sanitization or bounds enforcement. Because CVSS reports Scope:Changed, the flawed component runs in a context that can grant authority over a separate security domain - typical of management APIs or service daemons that broker access to underlying system-level functions on the device.
RemediationAI
Patch available per vendor advisory - apply the firmware/UniFi OS updates listed in Ubiquiti Security Advisory Bulletin 065 (https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a) for every affected gateway, NVR, NAS, Cloud Key, Express, and UniFi OS Server instance in the environment; specific fixed version numbers should be taken directly from that bulletin as they are not enumerated in the supplied input data. Until patches are deployed, restrict access to the UniFi OS management interface to a dedicated admin VLAN or jump host and block it at the perimeter, which prevents external low-privileged accounts from reaching the vulnerable endpoint at the cost of remote operator convenience. Audit and prune low-privileged UniFi user accounts, rotate credentials, and require MFA on the SSO/identity provider feeding UniFi, since the bug requires PR:L - removing untrusted operator accounts directly removes attack surface; the trade-off is operational friction for delegated site admins. Enable verbose audit logging on the UniFi controller and monitor for unexpected privilege changes or API calls from non-admin sessions until patching is complete.
More in Unifi Os Server
View allUnauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Command injection in Ubiquiti UniFi OS devices allows a high-privileged attacker on the network to execute arbitrary ope
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arb
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authentica
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across th
Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CW
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive
Path traversal in Ubiquiti UniFi OS devices allows authenticated low-privileged network attackers to read arbitrary file
Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious
Same weakness CWE-20 – Improper Input Validation
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today