CVE-2026-54402

State: Published
Severity: 9.9 Critical
Published: Jul 2, 2026
Updated: Jul 2, 2026
Reserved: Jun 13, 2026

Description

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

Scores

CVSS	Score	Vector	Source
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	hackerone

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
UniFi OS ServerUbiquiti Inc	before 5.1.19Affected
Dream MachinesUbiquiti Inc	before 5.1.19Affected
Enterprise Fortress GatewayUbiquiti Inc	before 5.1.19Affected
Dream WallUbiquiti Inc	before 5.1.19Affected
Dream RoutersUbiquiti Inc	before 5.1.19Affected
Express 7Ubiquiti Inc	before 5.1.19Affected
Cloud KeysUbiquiti Inc	before 5.1.19Affected
Network Video RecordersUbiquiti Inc	before 5.1.19Affected
Enterprise Video RecordersUbiquiti Inc	before 5.1.19Affected
Cloud GatewaysUbiquiti Inc	before 5.1.19Affected
Network Attached StorageUbiquiti Inc	before 5.1.19Affected
Enterprise Firewall CoreUbiquiti Inc	before 5.1.19Affected

References

https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.