UniFi Access EUVD-2026-66384

Exploitation requires network access to the UniFi Access Application interface plus a valid low-privilege authenticated session (CVSS PR:L) - it is not anonymous. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning once an attacker holds any low-privilege credential and can reach the service over the network, exploitation is straightforward against affected versions. The limiting factors defenders can rely on are: the mandatory low-privilege authentication, and network reachability of the management application - if the interface is confined to a trusted management segment and low-privilege accounts are tightly controlled, the realistic attack surface is substantially narrowed. The specific vulnerable input field/endpoint is not disclosed in the provided data.

The signals are consistent and point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) indicates a low-complexity, network-reachable attack needing only low privileges and no user interaction, yielding full host compromise across a scope boundary - an unusually severe combination. Tempering this: exploitation is NOT unauthenticated (PR:L requires a valid low-privilege account), there is no public POC, and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net: a credible critical-severity issue that warrants prompt patching, but the low-privilege authentication requirement meaningfully raises the bar versus a fully anonymous RCE.

An attacker who has obtained or been granted a low-privilege UniFi Access account (for example a limited operator login, or credentials reused/phished from staff) sends a crafted request containing shell metacharacters to a vulnerable input field over the network. Because the input is passed to an OS command without validation, the payload executes on the host device with the application's privileges, giving the attacker command execution and a foothold to pivot into the access-control infrastructure. No public exploit code is currently identified, so this scenario is based on the CVSS vector rather than an observed campaign.