by Kastro
Paper/Archive/CVE-2026-47369

CVE-2026-47369

Ubiquiti Inc UniFi OS Server — A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain…

EPSS 0.3%CVSS 9.9
critical.is priorityof 100
34
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 23.1.231 × 204.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Affected

ProductAffectedFixed inSource
UniFi OS Server< 5.1.155.1.15CNA
Express< 4.0.154.0.15CNA
UDM< 5.1.155.1.15CNA
UDM-Pro< 5.1.155.1.15CNA
UDM-SE< 5.1.155.1.15CNA
UDM-Pro-Max< 5.1.155.1.15CNA
UDM-Beast< 5.1.155.1.15CNA
EFG< 5.1.155.1.15CNA
UDW< 5.1.155.1.15CNA
UDR< 5.1.155.1.15CNA
UDR7< 5.1.155.1.15CNA
UDR-5G< 5.1.155.1.15CNA

Scores by source

hackerone (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcommunity.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a