CVE-2026-47370
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.
- Score
- CVSS 3.1 9.9 Critical
- Status
- Deferred - support@hackerone.com
- Published
- 2026-06-12
- Last modified
- 2026-06-13
- Weaknesses
- CWE-20
Affected products
- Efg (Ubiquiti Inc)
- Envr (Ubiquiti Inc)
- Envr-core (Ubiquiti Inc)
- Express (Ubiquiti Inc)
- Express 7 (Ubiquiti Inc)
- Ucg-fiber (Ubiquiti Inc)
- Ucg-industrial (Ubiquiti Inc)
- Ucg-max (Ubiquiti Inc)
- Ucg-ultra (Ubiquiti Inc)
- Uck (Ubiquiti Inc)
- Uck-enterprise (Ubiquiti Inc)
- Uckp (Ubiquiti Inc)
- Udm (Ubiquiti Inc)
- Udm-beast (Ubiquiti Inc)
- Udm-pro (Ubiquiti Inc)
- Udm-pro-max (Ubiquiti Inc)
- Udm-se (Ubiquiti Inc)
- Udr (Ubiquiti Inc)
- Udr-5g (Ubiquiti Inc)
- Udr7 (Ubiquiti Inc)
- Udw (Ubiquiti Inc)
- Unas-2 (Ubiquiti Inc)
- Unas-4 (Ubiquiti Inc)
- Unas-pro (Ubiquiti Inc)
- Unas-pro-4 (Ubiquiti Inc)
- Unas-pro-8 (Ubiquiti Inc)
- Unifi Os Server (Ubiquiti Inc)
- Unvr (Ubiquiti Inc)
- Unvr-g2 (Ubiquiti Inc)
- Unvr-g2-pro (Ubiquiti Inc)
- Unvr-instant (Ubiquiti Inc)
- Unvr-pro (Ubiquiti Inc)
References
- https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a
