EUVD-2026-66384Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable command injection needing a low-privilege account (PR:L) and no interaction; execution on the host escapes the app process (S:C) giving full C/I/A impact.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
AnalysisAI
Command injection in Ubiquiti's UniFi Access Application allows an authenticated attacker with low privileges and network access to execute arbitrary OS commands on the host device. Rated CVSS 9.9 with a scope change, the flaw stems from improper input validation and lets a low-privileged user break out of the application to compromise the underlying host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the UniFi Access Application interface plus a valid low-privilege authenticated session (CVSS PR:L) - it is not anonymous. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are consistent and point to genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or been granted a low-privilege UniFi Access account (for example a limited operator login, or credentials reused/phished from staff) sends a crafted request containing shell metacharacters to a vulnerable input field over the network. Because the input is passed to an OS command without validation, the payload executes on the host device with the application's privileges, giving the attacker command execution and a foothold to pivot into the access-control infrastructure. … |
| Remediation | Upgrade the UniFi Access Application to the fixed release identified in Ubiquiti Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9); the input data does not include an exact fixed version number, so confirm the target build directly from that advisory and enable automatic UniFi OS/application updates where supported. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, complete an inventory of all UniFi Access Application deployments and identify systems controlling critical network access points. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Unifi Access Application
View allCommand injection in Ubiquiti's UniFi Access Application lets a low-privileged attacker with network reach run arbitrary
Privilege escalation in Ubiquiti's UniFi Access Application allows a network-adjacent attacker holding only low-privileg
Command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network access to run arb
OS command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network reach to run a
Privilege escalation in Ubiquiti's UniFi Access Application allows an attacker who already holds high privileges and net
Arbitrary file disclosure in Ubiquiti's UniFi Access Application allows a network-adjacent, unauthenticated attacker to
Same weakness CWE-20 – Improper Input Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today