UniFi Network Application EUVD-2026-66360

Exploitation requires the attacker to already hold HIGH privileges (administrative access) on the UniFi Network Application controller and network reachability to it - this is confirmed by the CVSS vector PR:H/AV:N. The target of code execution is an adopted device actively managed by that controller, so at least one adopted UniFi device must be present and provisioned. Limiting factors: the mandatory high-privilege authentication level means an unauthenticated or low-privileged remote attacker cannot exploit this directly; the realistic threat is a malicious/compromised administrator or an attacker who has already taken over the controller's management plane. No user interaction is required (UI:N) and attack complexity is low (AC:L).

The CVSS 3.1 base score is 9.1 (Critical) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - network-reachable, low attack complexity, no user interaction, but requiring HIGH privileges (PR:H). The PR:H requirement is the dominant mitigating factor: an attacker must already possess high-privilege/administrative access to the controller before exploitation, which substantially narrows the realistic threat to insiders, compromised admin credentials, or an attacker who has already breached the management plane. No EPSS score was provided, the CVE is not in CISA KEV (no active exploitation), and no POC is referenced - so real-world exploitation pressure is currently low despite the Critical rating. The high CVSS is driven by the full-impact scope change on adopted devices, not by ease of initial access. Net: elevated severity if the management interface is exposed or admin credentials are weak, but not a mass-exploitation, unauthenticated internet-worm scenario.

An attacker who has obtained high-privilege administrative access to a UniFi Network Application controller - for example via stolen admin credentials or an insider with management rights - submits crafted input through a controller function that is relayed to an adopted device. Due to improper input validation, the input is interpreted as an OS command and executes on the adopted device, giving the attacker control over that network device. No public POC is currently referenced, and low attack complexity means exploitation is straightforward once the required privileges are held.