Enterprise Network Attached Storage
Monthly
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by injecting CRLF sequences, granting full control over the appliance under certain conditions. It affects a broad range of UniFi OS platforms including Cloud Gateways, Dream Machines/Routers, Cloud Keys, and Enterprise NVR/NAS hardware. Reported by Ubiquiti with a CVSS of 9.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the high scope-changing impact makes it a priority to patch.
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances running the UniFi OS platform, where leftover Active Debug Code (CWE-489) lets an authenticated low-privilege actor with network access elevate their privileges on the device. The flaw is vendor-reported via Ubiquiti Security Advisory Bulletin 067 and carries a 9.0 CVSS driven by a security-scope change and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the wide device footprint makes it a notable patch priority.
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate their rights to full administrative control, per Ubiquiti Security Advisory Bulletin 067 (CVE-2026-77536). The flaw stems from improper access control (CWE-284) and carries a near-maximum CVSS 9.9 due to a scope-changing impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to elevate to higher privileges on the affected device or instance due to an improper access control flaw. The issue spans Ubiquiti's core managed platforms - UniFi OS Server, Cloud Keys, Dream Machines/Routers, Cloud Gateways, NVR/Enterprise NVR, Enterprise NAS, and Enterprise Firewall/Fortress Gateway - and carries a critical CVSS 9.9 with a changed scope. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make it high priority.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by injecting CRLF sequences, granting full control over the appliance under certain conditions. It affects a broad range of UniFi OS platforms including Cloud Gateways, Dream Machines/Routers, Cloud Keys, and Enterprise NVR/NAS hardware. Reported by Ubiquiti with a CVSS of 9.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the high scope-changing impact makes it a priority to patch.
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances running the UniFi OS platform, where leftover Active Debug Code (CWE-489) lets an authenticated low-privilege actor with network access elevate their privileges on the device. The flaw is vendor-reported via Ubiquiti Security Advisory Bulletin 067 and carries a 9.0 CVSS driven by a security-scope change and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the wide device footprint makes it a notable patch priority.
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate their rights to full administrative control, per Ubiquiti Security Advisory Bulletin 067 (CVE-2026-77536). The flaw stems from improper access control (CWE-284) and carries a near-maximum CVSS 9.9 due to a scope-changing impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to elevate to higher privileges on the affected device or instance due to an improper access control flaw. The issue spans Ubiquiti's core managed platforms - UniFi OS Server, Cloud Keys, Dream Machines/Routers, Cloud Gateways, NVR/Enterprise NVR, Enterprise NAS, and Enterprise Firewall/Fortress Gateway - and carries a critical CVSS 9.9 with a changed scope. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make it high priority.