EUVD-2026-66392
GHSA-6v6q-fh74-2ph5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliveryReach network-exposed Access endpoint
-
ExploitSubmit crafted unvalidated input
-
ExecutionTrigger command injection on host
-
PersistExecute arbitrary OS commands as host
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires network reachability to the UniFi Access Application and a low-privileged authenticated foothold (CVSS PR:L) - it is not fully unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The concrete prerequisite drawn from the description is access to the network plus low privileges on the Access Application, from which improper input validation permits command injection on the host device. Limiting factors: the attacker must first hold a valid low-privilege credential and must be able to reach the application over the network, so segmenting the management interface and controlling low-privilege account issuance materially reduces realistic exposure. |
| Impact | The signals point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change and total confidentiality, integrity, and availability impact. PR:L means some authenticated foothold is required, which modestly limits exposure versus a fully unauthenticated flaw, but low-privilege accounts are common in access-control deployments. EPSS was not provided, so exploitation-probability cannot be quantified here. There is no KEV listing and no evidence of a public POC, so active exploitation is not confirmed - the score reflects potential impact, not observed in-the-wild use. Overall: a critical-severity issue warranting prompt patching, tempered by the low-privilege prerequisite and the current absence of known exploitation. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privileged account on the UniFi Access Application (for example, a limited operator credential) sends crafted input to a vulnerable, network-exposed endpoint. The malformed input is passed into an OS command without validation, executing attacker-chosen commands on the host device and yielding full control of the underlying system. No user interaction is required, and attack complexity is low. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network access to run arbitrary operating-system commands on the underlying host device. The flaw stems from improper input validation (CWE-20) and carries a critical CVSS 9.9 with a scope change, meaning application-level compromise pivots to full control of the host. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: upgrade the UniFi Access Application to the fixed release identified in Ubiquiti Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9); the exact fixed version number is not specified in the available data, so verify it directly in that bulletin before deploying. As compensating controls until the update is applied, restrict network access to the Access Application management interface to trusted administrative VLANs or a management network so that low-privileged and untrusted hosts cannot reach it, tighten and audit low-privilege application accounts to reduce the pool of potential attackers, and monitor the host for anomalous process execution. The trade-off of network restriction is that legitimate remote administration and integrations may break and require allow-listing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UniFi Access is Ubiquiti's physical access-control platform (door controllers, readers, and the management application) built on the broader UniFi ecosystem. The CPE cpe:2.3:a:ubiquiti_inc:unifi_access_application confirms the affected component is the server-side Access Application rather than a hardware reader. The root cause is CWE-20 Improper Input Validation: attacker-controlled input reaches an OS command construction path without adequate sanitization, enabling command injection. Because the vulnerable application runs on and can issue commands to the host device, exploitation crosses a trust boundary (CVSS scope change S:C), turning an application-level input flaw into host-level code execution.
Know when Unifi Access Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity command injection needing only low privileges; app-to-host command execution justifies scope change and full C/I/A impact.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
Executive ViewAI
Ubiquiti UniFi Access Application contains a critical command injection vulnerability (CVSS 9.9) enabling low-privileged attackers with network access to assume complete control of host devices, escalating from application compromise to full operating system access. Organizations using UniFi Access for physical security and network infrastructure face immediate risk of unauthorized system compromise, credential theft, and lateral movement into core network environments.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) network segmentation to restrict access to UniFi Access systems, (2) disable remote access and limit connections to trusted administrative networks only, (3) implement host-level firewalls blocking unexpected outbound connections, (4) deploy application-level monitoring and logging for anomalous command execution, (5) enforce multi-factor authentication for administrative access to UniFi systems, and (6) maintain offline backups of critical access control configurations. These controls reduce but do not eliminate risk; vendor patch deployment remains critical.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Unifi Access Application
View allOS command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network reach to run a
Command injection in Ubiquiti's UniFi Access Application allows an authenticated attacker with low privileges and networ
Command injection in Ubiquiti's UniFi Access Application lets a low-privileged attacker with network reach run arbitrary
Privilege escalation in Ubiquiti's UniFi Access Application allows a network-adjacent attacker holding only low-privileg
Privilege escalation in Ubiquiti's UniFi Access Application allows an attacker who already holds high privileges and net
Arbitrary file disclosure in Ubiquiti's UniFi Access Application allows a network-adjacent, unauthenticated attacker to
Exploit-DB