CVE-2026-47369
- State
- Published
- Severity
- 9.9 Critical
- Published
- Jun 12, 2026
- Updated
- Jun 13, 2026
- Reserved
- May 19, 2026
Description
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | hackerone |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
UniFi OS ServerUbiquiti Inc |
|
ExpressUbiquiti Inc |
|
UDMUbiquiti Inc |
|
UDM-ProUbiquiti Inc |
|
UDM-SEUbiquiti Inc |
|
UDM-Pro-MaxUbiquiti Inc |
|
UDM-BeastUbiquiti Inc |
|
EFGUbiquiti Inc |
|
UDWUbiquiti Inc |
|
UDRUbiquiti Inc |
|
UDR7Ubiquiti Inc |
|
UDR-5GUbiquiti Inc |
|
Express 7Ubiquiti Inc |
|
UNVRUbiquiti Inc |
|
UNVR-ProUbiquiti Inc |
|
UNVR-InstantUbiquiti Inc |
|
UNVR-G2Ubiquiti Inc |
|
UNVR-G2-ProUbiquiti Inc |
|
ENVRUbiquiti Inc |
|
ENVR-CoreUbiquiti Inc |
|
UNAS-2Ubiquiti Inc |
|
UNAS-4Ubiquiti Inc |
|
UNAS-ProUbiquiti Inc |
|
UNAS-Pro-4Ubiquiti Inc |
|
UNAS-Pro-8Ubiquiti Inc |
|
UCKPUbiquiti Inc |
|
UCKUbiquiti Inc |
|
UCK-EnterpriseUbiquiti Inc |
|
UCG-UltraUbiquiti Inc |
|
UCG-MaxUbiquiti Inc |
|
UCG-FiberUbiquiti Inc |
|
UCG-IndustrialUbiquiti Inc |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.