Unifi Gateways
Monthly
Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an out-of-bounds write (CWE-787) in the affected firmware, producing a denial-of-service condition that can take the device offline or force a reboot. Tracked as CVE-2026-95862 with a CVSS 3.1 score of 7.5 (HIGH) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the flaw is reachable over the network without credentials or user interaction, but its impact is confined entirely to availability - no confidentiality or integrity loss, and no code execution or data disclosure is indicated. Affected product families per the vendor's CPE data include Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways; so far there is no public exploit identified at time of analysis and the issue has not been marked as confirmed actively exploited (CISA KEV).
Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways) allows an unauthenticated remote attacker reachable over the network to crash the device by triggering uncontrolled recursion (CWE-674), rated CVSS 3.1 base 7.5 HIGH with impact confined to availability (C:N/I:N/A:H). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials or user interaction are required and complexity is low; the practical gating factor is exposure of the affected service, so gateways with management/service interfaces reachable from the internet or untrusted networks are directly at risk while LAN-confined deployments are exploitable only by a host already on that segment. The outcome is limited to device crash/reboot with no data exposure or code execution; no public exploit identified at time of analysis and no KEV or EPSS data was provided.
Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CWE-125) that crashes the device, producing a denial-of-service condition rated 7.5 HIGH. The issue affects the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express/Express 7, and generic UniFi Gateway product lines, and no public exploit code was identified at time of analysis. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no credentials, user interaction, or special configuration are required - the practical constraint is network exposure, since the attack surface shrinks considerably if the vulnerable service is bound only to a trusted LAN or management interface rather than the WAN or untrusted segments.
Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and other UniFi gateways) can be triggered by an unauthenticated network attacker who sends crafted input to a vulnerable interface, causing an out-of-bounds read (CWE-125) that crashes the device. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, but impact is limited to availability with no confidentiality or integrity loss. Exploitation requires the attacker to reach the exposed vulnerable service; if the affected parser listens only on LAN or management interfaces rather than the WAN, an internet-based attacker would need a foothold. No public exploit code or active exploitation has been identified at time of analysis.
Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways-allows unauthenticated remote attackers to crash the device, causing a denial of service. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact with no confidentiality or integrity loss. No public exploit identified at time of analysis; Ubiquiti Security Advisory Bulletin 069 provides remediation guidance.
Unauthenticated remote attackers who can reach the network-facing services of certain Ubiquiti UniFi gateway devices can trigger an out-of-bounds write that crashes the device, producing a denial-of-service condition (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The affected product lines span the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7 and general UniFi Gateway families, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exposure is bounded by network position: the CVSS vector confirms no authentication or user interaction is required, but the attacker must still be able to send traffic to the vulnerable service, so gateways whose attack surface is confined to trusted internal segments are materially less exposed than devices reachable from the WAN or other untrusted networks.
Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an out-of-bounds write (CWE-787) in the affected firmware, producing a denial-of-service condition that can take the device offline or force a reboot. Tracked as CVE-2026-95862 with a CVSS 3.1 score of 7.5 (HIGH) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the flaw is reachable over the network without credentials or user interaction, but its impact is confined entirely to availability - no confidentiality or integrity loss, and no code execution or data disclosure is indicated. Affected product families per the vendor's CPE data include Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways; so far there is no public exploit identified at time of analysis and the issue has not been marked as confirmed actively exploited (CISA KEV).
Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways) allows an unauthenticated remote attacker reachable over the network to crash the device by triggering uncontrolled recursion (CWE-674), rated CVSS 3.1 base 7.5 HIGH with impact confined to availability (C:N/I:N/A:H). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials or user interaction are required and complexity is low; the practical gating factor is exposure of the affected service, so gateways with management/service interfaces reachable from the internet or untrusted networks are directly at risk while LAN-confined deployments are exploitable only by a host already on that segment. The outcome is limited to device crash/reboot with no data exposure or code execution; no public exploit identified at time of analysis and no KEV or EPSS data was provided.
Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CWE-125) that crashes the device, producing a denial-of-service condition rated 7.5 HIGH. The issue affects the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express/Express 7, and generic UniFi Gateway product lines, and no public exploit code was identified at time of analysis. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no credentials, user interaction, or special configuration are required - the practical constraint is network exposure, since the attack surface shrinks considerably if the vulnerable service is bound only to a trusted LAN or management interface rather than the WAN or untrusted segments.
Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and other UniFi gateways) can be triggered by an unauthenticated network attacker who sends crafted input to a vulnerable interface, causing an out-of-bounds read (CWE-125) that crashes the device. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, but impact is limited to availability with no confidentiality or integrity loss. Exploitation requires the attacker to reach the exposed vulnerable service; if the affected parser listens only on LAN or management interfaces rather than the WAN, an internet-based attacker would need a foothold. No public exploit code or active exploitation has been identified at time of analysis.
Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways-allows unauthenticated remote attackers to crash the device, causing a denial of service. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact with no confidentiality or integrity loss. No public exploit identified at time of analysis; Ubiquiti Security Advisory Bulletin 069 provides remediation guidance.
Unauthenticated remote attackers who can reach the network-facing services of certain Ubiquiti UniFi gateway devices can trigger an out-of-bounds write that crashes the device, producing a denial-of-service condition (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The affected product lines span the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7 and general UniFi Gateway families, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exposure is bounded by network position: the CVSS vector confirms no authentication or user interaction is required, but the attacker must still be able to send traffic to the vulnerable service, so gateways whose attack surface is confined to trusted internal segments are materially less exposed than devices reachable from the WAN or other untrusted networks.