Brief Summary: CVE-2026-47367 Command Injection in Ubiquiti UID Enterprise Agent (CVSS 9.9)

Introduction

A critical command injection flaw in Ubiquiti's UID Enterprise Agent lets any low-privilege user with network access execute arbitrary commands on the host device. One successful attack could compromise physical access control systems, VPN infrastructure, and single sign-on tokens at once. CVE-2026-47367 was disclosed in Security Advisory Bulletin 065 alongside two other CVSS 9.9 vulnerabilities, and it is the latest in a pattern of severe input validation failures across Ubiquiti's product line in 2026.

The UID Enterprise Agent is a software component deployed on Ubiquiti UniFi Consoles. It connects on-premises network hardware to the cloud-based UID Enterprise Manager, and it enforces centrally managed policies for door access, WiFi authentication, VPN connectivity, and SaaS SSO across Ubiquiti's identity and access management ecosystem. With $3+ billion in trailing twelve-month revenue and an expanding enterprise footprint, Ubiquiti has put this agent between IT and physical security infrastructure in a growing number of organizations.

Technical Information

Root Cause: CWE-20 to CWE-77 Chain

CVE-2026-47367 is classified under CWE-20: Improper Input Validation. Per MITRE's definition, CWE-20 occurs when "the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly." Here, the UID Enterprise Agent fails to properly validate input, so an attacker can inject operating system commands that execute on the host device.

CWE-20 is a root cause weakness that frequently leads to child weaknesses such as CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'). CVE-2026-47367 follows this parent-to-child pattern. Improper input validation at the application layer lets special characters or command sequences pass through unsanitized, and they arrive at the operating system layer as injected commands.

CVSS Vector Breakdown

The full CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which gives a base score of 9.9 Critical:

Scope: Changed means the vulnerability in the UID Enterprise Agent can affect resources beyond the agent itself, potentially the entire UniFi Console and the systems it manages.

Attack Vector Analysis

The prior Security Advisory Bulletin 064 required "high privileges" for its UniFi OS vulnerabilities. This one requires only "low privileges", so any low-privilege user on the network, such as a standard employee account, could exploit the flaw. That is a far larger pool of potential attackers than the previous bulletin faced.

In a plausible exploitation path, an attacker first gains low-privilege network access through a compromised user account, lateral movement from another breach, or presence on the same network segment. The attacker then sends the UID Enterprise Agent crafted input containing command injection payloads. Because the agent fails to properly validate this input, the injected commands execute with the privileges of the agent process on the host device. The agent runs on UniFi Consoles, which often operate with elevated system privileges, so command injection could yield control over the entire console.

The UID Enterprise Agent's Role and Blast Radius

The UID Enterprise Agent authenticates to the cloud manager with a Security Token that requires MFA to generate and is valid for only 10 minutes. That token protects the agent-to-cloud channel. CVE-2026-47367, however, exploits how the agent processes input locally on the host device, so the attack bypasses the cloud-channel authentication layer entirely. The agent's cloud-facing security controls are strong, but they do nothing against a command injection at the local host level.

The agent manages door access, WiFi, VPN, and SSO policies. A successful command injection could therefore give an attacker control over physical access systems, VPN credentials, and single sign-on tokens, and with them a pivot point into the wider enterprise environment across both IT and physical security.

Chaining Potential with Bulletin 065 Companion CVEs

Security Advisory Bulletin 065 contains three CVSS 9.9 vulnerabilities: command injection (this CVE), privilege escalation, and path traversal. Bishop Fox researchers previously demonstrated that chaining three UniFi OS vulnerabilities (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) enables unauthenticated root RCE on UniFi consoles. By analogy, an attacker could chain CVE-2026-47367's low-privilege command injection with the privilege escalation and path traversal flaws in the same bulletin, going from low-privilege network access to full system compromise without high-privilege credentials. Patching only one of the three is not enough.

Patch Information

Ubiquiti released UID Enterprise Agent version 1.61.4 on June 10, 2026, as part of Security Advisory Bulletin 065. The vulnerability affects UID Enterprise Agent version 1.61.3 and earlier. Security researcher Abdulaziz Almadhi of Catchify Security originally reported it, and the fix was coordinated through Ubiquiti's HackerOne bug bounty program.

The release notes for version 1.61.4 are characteristically terse. They list "Improved system performance" under Improvements and one bugfix entry confirming it "Fixed the security issues mentioned in Security Advisory Bulletin 065." Ubiquiti has not shared a code-level diff or implementation details, which is consistent with its closed-source firmware update model. Public documentation does not say how the input validation was hardened, such as which input vectors were sanitized or which command injection payloads are now blocked.

The patch presumably adds proper input sanitization to the affected code path in the UID Enterprise Agent, which would close the command injection surface behind the scope change in the CVSS vector.

Update paths:

1. UID Enterprise Manager interface: Update directly from the cloud management console.
2. UniFi Site Manager: Update manually, or enable Auto Update for automated patch deployment.

Organizations should also upgrade UniFi OS to version 5.1.15 or later to fix the companion privilege escalation and path traversal vulnerabilities in Bulletin 065. Patching the agent without updating UniFi OS leaves the other two CVSS 9.9 flaws in place and available for chaining attacks.

Post-patch verification steps:

1. Confirm the UID Enterprise Agent version is 1.61.4 or later via the UID Enterprise Manager or UniFi Site Manager.
2. Confirm UniFi OS firmware is 5.1.15 or later on all consoles.
3. Check for unauthorized "Super Admin" accounts or unexpected admin invitations. Community reports cite both as indicators of compromise following recent Ubiquiti vulnerabilities.
4. Review audit logs for suspicious command execution patterns on consoles hosting the UID Enterprise Agent.

Affected Systems and Versions

The UID Enterprise Agent runs on Ubiquiti UniFi Consoles. Any deployment where the agent is installed and accessible over the network is potentially vulnerable. Because exploitation needs only low privileges, any environment where an authenticated user can reach the agent's network interface is at risk.

Vendor Security History

Ubiquiti's 2026 security track record shows a concerning pattern of critical vulnerabilities across consecutive security bulletins:

CWE-20 (Improper Input Validation) and related weaknesses (CWE-77, CWE-1287) recur across three consecutive bulletins, which points to a systemic issue rather than isolated coding errors. The history goes back further, too. CVE-2019-25651 is an information disclosure flaw in the UniFi Network Controller involving weak AES-CBC encryption.

Bishop Fox researchers independently discovered and chained CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 for unauthenticated root RCE on UniFi OS Server versions 5.0.6 and earlier, which showed that UniFi OS flaws are practically exploitable when combined.

The Cyber Security Agency of Singapore issued formal alert AL-2026-025 covering Ubiquiti UniFi Network Application vulnerabilities. The alert is a sign of international government concern about the vendor's security posture.

Ubiquiti runs a HackerOne bug bounty program and issues timely advisories with specific patch versions. Even so, the frequency and severity of these disclosures raise questions about how thorough its pre-release security testing is, particularly around input validation across the product stack. Organizations should expect more CWE-20-derived vulnerabilities in future disclosures and plan their Ubiquiti deployments with defense-in-depth controls that do not depend on patching alone.

Threat Actor Targeting

Ubiquiti devices have a documented history of active exploitation by both state-sponsored and criminal threat actors. According to Truesec, "Ubiquiti has explicitly warned that both state-sponsored threat actors and cybercriminal groups actively target its devices for botnet-building and operational obfuscation."

The most prominent confirmed exploitation involves Russia's GRU military intelligence service. The FBI dismantled a botnet of compromised Ubiquiti Edge OS routers that the GRU operated. After Bulletin 065 was released, Reddit users on r/UNIFI reported unauthorized "Super Admin" account invitations and compromises through WAN-facing interfaces. The reports are anecdotal, but they are consistent with the attack pattern that CVE-2026-47367 and its companion CVEs make possible.

As of June 12, 2026, there is no confirmed evidence that CVE-2026-47367 specifically has been exploited in the wild. However, it was reported through HackerOne (responsible disclosure), which typically means a narrow window between patch availability and the appearance of public exploit code. Attackers have repeatedly targeted Ubiquiti vulnerabilities soon after disclosure, which suggests that delaying the patch increases exposure disproportionately.

References

• NVD: CVE-2026-47367
• Ubiquiti Security Advisory Bulletin 065
• UID Enterprise Agent 1.61.4 Release Notes
• Security Online: UniFi OS Vulnerabilities CVSS 9.9
• Ubiquiti Security Advisory Bulletin 062
• Ubiquiti Security Advisory Bulletin 064
• Bulletin 065 Community Discussion
• Managing Your UniFi Consoles and UID Enterprise Agent
• UniFi Identity Product Page
• MITRE CWE-20: Improper Input Validation
• MITRE CWE-77: Command Injection
• Truesec: Vulnerabilities in Ubiquiti UniFi Network Application
• BleepingComputer: Critical UniFi OS Bug Enables Root Without Authentication
• Cyber Security Agency of Singapore Alert AL-2026-025
• Censys Advisory: CVE-2026-22557
• Reddit r/UNIFI: PSA Security Advisory Bulletin 065
• Ubiquiti Community: Exploitation in the Wild of UniFi Devices
• OpenCVE: Ubiquiti CVEs