EUVD-2026-66382
GHSA-fqc4-369q-46m3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable console with a required low-privilege account (PR:L) and no user interaction; broken authorization yields full device compromise across a privilege boundary, so S:C and C/I/A:H.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
Articles & Coverage 1
AnalysisAI
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to elevate to higher privileges on the affected device or instance due to an improper access control flaw. The issue spans Ubiquiti's core managed platforms - UniFi OS Server, Cloud Keys, Dream Machines/Routers, Cloud Gateways, NVR/Enterprise NVR, Enterprise NAS, and Enterprise Firewall/Fortress Gateway - and carries a critical CVSS 9.9 with a changed scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold a low-privileged, authenticated account on the target UniFi OS device or instance (CVSS PR:L) and network access to its management interface (AV:N); no user interaction and no special non-default feature toggle is called out in the description, so default-configured devices with any low-tier account are exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward genuine high priority: the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H) describes a remotely reachable, low-complexity flaw needing only a low-privileged account and no user interaction, with a scope change indicating impact beyond the initially authorized boundary - hence the 9.9 rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a low-privileged UniFi OS account - for example a limited staff operator login, a guest-tier management account, or reused/leaked credentials - connects to the device's web console or API over the network and invokes functionality that should be gated behind an administrator role. Because the access control check is improperly enforced, the request succeeds and the attacker gains elevated privileges over the device, potentially taking full control of the gateway, NVR, or UniFi OS Server. … |
| Remediation | Patch available per vendor advisory - upgrade UniFi OS and the affected application/firmware on all listed devices to the fixed builds published in Ubiquiti Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9); exact fixed version numbers are not in the provided data and must be taken from that bulletin. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Ubiquiti UniFi OS deployments and identify which systems are network-exposed and which accounts hold low-privileged access across servers, Cloud Keys, Dream Machines, Cloud Gateways, NVR systems, Enterprise NAS, and Enterprise Firewall or Fortress Gateway appliances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Unifi Os Server
View allUnauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Command injection in Ubiquiti UniFi OS devices allows a high-privileged attacker on the network to execute arbitrary ope
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege access and network reachability
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege (administrative) access on the n
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances runni
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today