EUVD-2026-84762
GHSA-r98h-7hpp-wq9w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach gateway network interface
-
DeliverySend crafted malformed input
-
ExploitTrigger out-of-bounds write
-
ExecutionCorrupt memory / crash service
-
ImpactGateway DoS and loss of connectivity
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the affected UniFi gateway service - no authentication, no user interaction (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is exposure: the attacker must be able to reach the vulnerable interface, so gateways whose management/vulnerable service is confined to trusted LAN segments are far less exposed than those reachable from the WAN or untrusted VLANs. Affected models per CPE: Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways. Impact is limited to Denial of Service (device crash/reboot); no code execution or data disclosure is indicated. No fixed firmware version is stated in the advisory, so remediation requires checking Bulletin-069 for the patched release. |
| Impact | CVSS 7.5 (HIGH) is driven entirely by availability: the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H describes a network-reachable, unauthenticated, low-complexity attack with NO confidentiality or integrity impact - a pure Denial of Service. Despite CWE-787 (Out-of-bounds Write) being a memory-corruption class that CAN sometimes lead to code execution, both the vendor description ('execute a Denial of Service') and the impact metrics (C:N/I:N) explicitly scope this to a crash/reboot, not RCE - treat the score as availability-only, not a code-execution risk. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation; per precision rules this is 'no public exploit identified at time of analysis.' The single self-reported Ubiquiti advisory (Bulletin-069) provides no fixed firmware version, which is a notable gap for remediation planning. Net: real but bounded risk - an internet-exposed UniFi gateway management/WAN interface could be knocked offline by an unauthenticated attacker, but the blast radius is service disruption, not data theft or takeover. Prioritize based on whether the affected gateway surface is reachable from untrusted networks. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to a vulnerable UniFi gateway sends a crafted packet or request to the affected service, triggering an out-of-bounds write that corrupts memory and crashes the process or device, dropping connectivity for everything behind the gateway. No POC is publicly available and no active exploitation is documented; the low attack complexity (AC:L) means that if a working trigger is discovered, it would be trivially repeatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an out-of-bounds write (CWE-787) in the affected firmware, producing a denial-of-service condition that can take the device offline or force a reboot. Tracked as CVE-2026-95862 with a CVSS 3.1 score of 7.5 (HIGH) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the flaw is reachable over the network without credentials or user interaction, but its impact is confined entirely to availability - no confidentiality or integrity loss, and no code execution or data disclosure is indicated. Affected product families per the vendor's CPE data include Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways; so far there is no public exploit identified at time of analysis and the issue has not been marked as confirmed actively exploited (CISA KEV).
RemediationAI
No fixed firmware version is stated in the available advisory data, so remediation requires consulting Ubiquiti Security Advisory Bulletin 069 (https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c) to identify the patched release for each affected family - Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways - and then upgrading those devices to the vendor-specified firmware. Patch status should be treated as unconfirmed pending that advisory; there is no vendor-released patch version identified in the supplied data. Because the attack requires only network reachability with no authentication, the most effective compensating control is exposure reduction: block the vulnerable gateway service from the WAN and from untrusted VLANs with upstream firewall or provider rules, and restrict management and remote-access interfaces to a dedicated trusted management segment - the trade-off is that this breaks legitimate remote administration until a maintenance path (VPN or jump host on the trusted segment) is established. Disable unnecessary remote-access features such as cloud/remote UI access, UPnP, and any WAN-exposed management listeners where they are not operationally required, accepting reduced convenience in exchange for removing the attack surface. Segment IoT and guest traffic away from the gateway's exposed interfaces to limit who can reach the vulnerable service, and monitor gateway logs for repeated crashes, unexpected reboots, or watchdog resets that would indicate exploitation attempts. Note that because impact is availability-only, these measures prioritize uptime and segmentation rather than data-breach containment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 8 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a classic CWE-787 out-of-bounds write - memory corruption in the network-processing path of Ubiquiti's UniFi gateway firmware, where a length or bounds check is missing or insufficient when handling attacker-supplied data. Because the write occurs outside the intended buffer, the affected process or kernel path can corrupt adjacent memory, crash, or trigger a watchdog reboot of the device, which is the mechanism behind the availability-only impact described in the CVSS vector (C:N/I:N/A:H). The vulnerability is exposed through the network stack (AV:N) with low attack complexity (AC:L) and no privileges or user interaction required (PR:N/UI:N), meaning the attacker only needs IP reachability to the vulnerable service rather than any form of authentication. Ubiquiti's CPE strings show the flaw spans a broad firmware lineage of gateway-class hardware - Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways - indicating shared firmware code rather than an issue isolated to a single model.
Know when Express gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable trigger (AV:N/AC:L/PR:N/UI:N); vendor scopes impact to DoS so C:N/I:N/A:H with no scope change.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Articles & Coverage 2
Executive ViewAI
Ubiquiti UniFi gateways and related Dream, Cloud, Enterprise, and Express product families are exposed to an unauthenticated network denial-of-service condition that can take edge devices offline or force reboots, disrupting connectivity for users and sites that depend on them. Because no vendor patch is currently available and the flaw can be triggered remotely without credentials, leadership should treat this as a high-priority availability risk for any organization relying on these devices for network access, branch connectivity, or remote operations. There is no indication of data theft or code execution, but repeated outages could affect business services, customer-facing operations, and incident-response capacity.
No vendor-released patch identified at time of analysis; restrict network exposure of affected gateways, segment and firewall management and WAN paths, enable vendor or third-party IPS/IDS signatures where available, rate-limit untrusted traffic, monitor for reboots or crashes, maintain offline backups and redundant or failover gateways, and engage Ubiquiti support for interim mitigations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Denial of Service vulnerability in Multer (Node.js multipart form-data middleware) affecting versions 1.4.4-lts.1 throug
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive
Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterpri
Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CW
Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewa
Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wal
Exploit-DB