CVE-2026-47368
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such UniFi OS devices or instances.
- Score
- CVSS 3.1 8.6 High
- Status
- Deferred - support@hackerone.com
- Published
- 2026-06-12
- Last modified
- 2026-06-12
- Weaknesses
- CWE-22
Affected products
- Efg (Ubiquiti Inc)
- Envr (Ubiquiti Inc)
- Envr-core (Ubiquiti Inc)
- Express (Ubiquiti Inc)
- Express 7 (Ubiquiti Inc)
- Ucg-fiber (Ubiquiti Inc)
- Ucg-industrial (Ubiquiti Inc)
- Ucg-max (Ubiquiti Inc)
- Ucg-ultra (Ubiquiti Inc)
- Uck (Ubiquiti Inc)
- Uck-enterprise (Ubiquiti Inc)
- Uckp (Ubiquiti Inc)
- Udm (Ubiquiti Inc)
- Udm-beast (Ubiquiti Inc)
- Udm-pro (Ubiquiti Inc)
- Udm-pro-max (Ubiquiti Inc)
- Udm-se (Ubiquiti Inc)
- Udr (Ubiquiti Inc)
- Udr-5g (Ubiquiti Inc)
- Udr7 (Ubiquiti Inc)
- Udw (Ubiquiti Inc)
- Unas-2 (Ubiquiti Inc)
- Unas-4 (Ubiquiti Inc)
- Unas-pro (Ubiquiti Inc)
- Unas-pro-4 (Ubiquiti Inc)
- Unas-pro-8 (Ubiquiti Inc)
- Unifi Os Server (Ubiquiti Inc)
- Unvr (Ubiquiti Inc)
- Unvr-g2 (Ubiquiti Inc)
- Unvr-g2-pro (Ubiquiti Inc)
- Unvr-instant (Ubiquiti Inc)
- Unvr-pro (Ubiquiti Inc)
References
- https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a
