What is the CVSS score of EUVD-2026-36383?

EUVD-2026-36383 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of UniFi OS are affected by EUVD-2026-36383?

Ubiquiti UniFi OS devices-including UniFi Dream Machine, Express, UDR, UCG, UNVR, UNAS, and related platforms-are vulnerable to a critical privilege escalation (CVSS 9.9) that allows low-privileged…. A patch is available.

How to fix or mitigate EUVD-2026-36383?

Within 24 hours: Audit your network to identify all UniFi OS instances (Dream Machine, Express, UDR, UCG, UNVR, UNAS) and document their current network exposure and administrative access controls. Within 7 days: Restrict network access to UniFi management interfaces to trusted administrative networks only via firewall segmentation; disable remote management if not operationally required. Within 30 days: Monitor Ubiquiti security advisories for vendor-released patches; prepare and execute a change management plan to update all affected devices to patched versions as soon as available.

UniFi OS EUVD-2026-36383

| CVE-2026-47369 CRITICAL

Improper Input Validation (CWE-20)

2026-06-12 hackerone

GHSA-h6vq-x5fv-h7q3

Privilege Escalation Express Udm Udr Ubiquiti Unifi Os Server Udm Pro Udm Se Udm Pro Max Udm Beast Efg Udw Udr7 Udr 5G Express 7 Unvr Unvr Pro Unvr Instant Unvr G2 Unvr G2 Pro Envr Envr Core Unas 2 Unas 4 Unas Pro Unas Pro 4 Unas Pro 8 Uckp Uck Uck Enterprise Ucg Ultra Ucg Max Ucg Fiber Ucg Industrial Ubiquiti Inc

9.9

CVSS 3.1 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Management interface is network-reachable (AV:N), exploitation is straightforward (AC:L), a low-privileged UniFi account is required (PR:L), and escalation to full device admin crosses a security boundary (S:C, C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 12, 2026 - 05:01 EUVD

Analysis Generated

Jun 12, 2026 - 03:48 vuln.today

DescriptionCVE.org

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Articles & Coverage 2

News 4 New Ubiquiti Vulnerabilities - 2 Critical, 2 High Severity Jun 13, 2026 News Critical Privilege Escalation in Ubiquiti UniFi OS - CVE-2026-47369 Jun 12, 2026

AnalysisAI

Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on affected UniFi OS devices and instances due to improper input validation (CWE-20). The CVSS 9.9 score reflects a scope-changing impact spanning UniFi Dream Machine, UniFi Express, UDR, UCG, UNVR, UNAS, and other UniFi OS Server platforms. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

UniFi OS is Ubiquiti's unified management platform that runs on Dream Machine (UDM/UDM Pro/UDM SE/UDM Pro Max/UDM Beast), Cloud Gateway (UCG Ultra/Max/Fiber/Industrial), Dream Router (UDR/UDR7/UDR 5G), Network Video Recorders (UNVR family, ENVR), NAS appliances (UNAS 2/4/Pro family), Cloud Keys (UCK/UCKP/UCK Enterprise), Express gateways, EFG, and the standalone UniFi OS Server. The root cause is CWE-20 Improper Input Validation, meaning untrusted input reaches a privileged operation without adequate sanitization or bounds enforcement. Because CVSS reports Scope:Changed, the flawed component runs in a context that can grant authority over a separate security domain - typical of management APIs or service daemons that broker access to underlying system-level functions on the device.

RemediationAI

Patch available per vendor advisory - apply the firmware/UniFi OS updates listed in Ubiquiti Security Advisory Bulletin 065 (https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a) for every affected gateway, NVR, NAS, Cloud Key, Express, and UniFi OS Server instance in the environment; specific fixed version numbers should be taken directly from that bulletin as they are not enumerated in the supplied input data. Until patches are deployed, restrict access to the UniFi OS management interface to a dedicated admin VLAN or jump host and block it at the perimeter, which prevents external low-privileged accounts from reaching the vulnerable endpoint at the cost of remote operator convenience. Audit and prune low-privileged UniFi user accounts, rotate credentials, and require MFA on the SSO/identity provider feeding UniFi, since the bug requires PR:L - removing untrusted operator accounts directly removes attack surface; the trade-off is operational friction for delegated site admins. Enable verbose audit logging on the UniFi controller and monitor for unexpected privilege changes or API calls from non-admin sessions until patching is complete.