CVE-2026-47369: A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances

Synopsis

An improper input validation vulnerability in Ubiquiti UniFi OS allows a network-adjacent attacker with only a low-privilege account to escalate privileges on affected devices and instances. The vulnerability is reachable over the network, requires no victim interaction, and carries a CVSS 9.9 Critical score due to its scope-changing, full-system impact. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected UniFi OS device. Patched-image rebuilds at versions 4.0.15, 5.1.15, and 5.1.16 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the UniFi OS service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationRequired

  The attacker needs a valid low-privilege account on the device or instance; PR:L means any standard user credential is sufficient, but unauthenticated access alone is not enough.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; UI:N means the attacker can trigger the vulnerability entirely on their own.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other variable environmental factors.

Blast Radius

• The attacker gains full read access to all data on the UniFi OS device, including stored credentials, network configuration, and logs.
• The attacker can write or modify any data on the device, including firewall rules, routing tables, and user account definitions.
• The attacker can crash or fully disable the UniFi OS service, taking down network management and any dependent infrastructure.
• Because the CVSS vector specifies a scope change (S:C), the attacker can pivot beyond the initially compromised device and affect other systems in the same trust boundary.