UniFi OS EUVD-2026-66398

Exploitation requires network access to an affected UniFi OS device's authentication interface (AV:N, PR:N - no credentials needed) and the ability to inject CRLF sequences into the auth flow. Ubiquiti explicitly scopes it to 'certain conditions,' matching the CVSS AC:H rating: the attack is not guaranteed and likely depends on a specific device state, request timing, or deployment configuration rather than working against every instance on demand. Limiting factors are the high attack complexity and the need for reachability to the management plane - if the UniFi OS admin interface is confined to a trusted management network or VPN and not internet-exposed, the practical attack surface is substantially narrowed. No user interaction is required.

Signals are mixed but lean toward real priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H = 9.0) indicates a remote, unauthenticated attack with no user interaction that yields full confidentiality/integrity/availability impact and a scope change - consistent with a total authentication bypass of a security appliance. The mitigating factor is AC:H combined with the description's 'under certain conditions,' meaning exploitation is not trivially repeatable and likely requires a specific state, timing, or configuration to win. No EPSS score, no SSVC decision data, and no POC were provided, and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation yet. This is a high-CVSS issue whose real-world exploitability is gated by the 'certain conditions' the vendor references - treat it as urgent to patch given the appliance's role and network exposure, while recognizing that widespread opportunistic exploitation is not currently demonstrated.

An attacker with access to the same network as a UniFi gateway or Cloud Key sends specially crafted requests containing embedded CRLF sequences to the UniFi OS authentication endpoint, splitting or forging the request/response to make the system accept the session as authenticated. Having bypassed login, the attacker gains administrative control of the appliance and the network it manages. No public exploit code is identified at this time, and the elevated attack complexity (AC:H) means the attacker must satisfy the 'certain conditions' to succeed.