Brief Summary: CVE-2026-47368 Path Traversal in Ubiquiti UniFi OS and Its Role in a Five CVE Bulletin

Introduction

Ubiquiti's UniFi OS just received its third major security bulletin in under three months. This one bundles five CVEs, including a path traversal flaw that lets a network-adjacent attacker read arbitrary files from affected devices. CVE-2026-47368 scores 8.6 on NVD (9.9 in Ubiquiti's own assessment). It sits alongside command injection and privilege escalation vulnerabilities that, when chained, could lead to complete device compromise.

Technical Information

Root Cause: CWE-22 Path Traversal

CVE-2026-47368 falls under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The flaw is in the UniFi OS application layer, where insufficient input validation on file path parameters lets an attacker inject directory traversal sequences (such as ../) into requests. The attacker can then escape the intended directory and read arbitrary files on the device's underlying filesystem.

The official NVD description states: "A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such UniFi OS devices or instances."

UniFi OS is closed-source firmware, so no source-level diff or vulnerable code snippet is publicly available. The fix ships only in official firmware images.

Attack Vector and Prerequisites

The attack requires network adjacency. The attacker must be on the same local network segment as the UniFi OS device or have a route to its management interface. That is a meaningful constraint next to the Bulletin 064 vulnerabilities, which could be exploited over the WAN. Community discussion on Reddit confirms that the Bulletin 065 vulnerabilities require local network access and have "no remote execution."

The advisory also states that this CVE can be chained with other vulnerabilities to remove the requirement for low-privileged access. Combined with the four other CVEs in Bulletin 065 (CVE-2026-47367, CVE-2026-47369, CVE-2026-47370, CVE-2026-48610), the effective attack surface may be broader than the path traversal alone suggests.

Vulnerability Chaining Context

The chaining concern has a recent precedent. A June 8, 2026 BleepingComputer report documented that three previously patched UniFi OS vulnerabilities from Bulletin 064 (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) could be chained to achieve unauthenticated remote code execution with root privileges on the UniFi OS Server. That chain combined an access control flaw, a path traversal flaw, and an input validation flaw.

Bulletin 065 contains a similar mix of vulnerability classes: path traversal (CVE-2026-47368), command injection, and privilege escalation via improper input validation. The CSA Singapore advisory (AL-2026-059) warns that chaining vulnerabilities in the same bulletin could lead to "complete compromise of the target device."

CVSS Scoring Discrepancy

NVD assigned a score of 8.6 (High), while Ubiquiti rates the vulnerability at CVSS 9.9 (Critical). The full CVSS v3.1 vector string was not yet populated in the NVD entry at the time of publication. The gap likely comes from how each side weighted the network-adjacent attack vector, with Ubiquiti scoring exploitability higher because path traversal attacks are low complexity and can be chained, and NVD taking a more conservative view of the adjacency requirement.

Bulletin 065 Vulnerability Summary

Researcher Brandon Rossi is credited with discovering CVE-2026-47368 and reported it through the HackerOne bug bounty program. HackerOne also served as the CNA for this CVE.

Patch Information

Ubiquiti fixed CVE-2026-47368 in firmware updates released on June 10, 2026, and documented them in Security Advisory Bulletin 065. As with the vulnerable code, no source-level diff is public, because the fix ships only in official firmware images.

The fixed firmware versions vary by device family:

Most device families are patched at 5.1.15, but the UNAS (Network Attached Storage) line needs 5.1.16, and the Express line has its own branch at 4.0.15. The NAS and Express products run different firmware branches from the main UniFi OS gateway/recorder family, so the path traversal fix landed at slightly different version numbers on each branch.

UniFi OS console users (Dream Machine, Dream Wall, Dream Router, Cloud Key, Cloud Gateway) should apply the firmware update through their device management interface. Self-hosted UniFi OS Server administrators should download version 5.1.15 from the Ubiquiti downloads page.

Important: Patching CVE-2026-47368 on its own is not enough. Address all five Bulletin 065 CVEs together, because the advisory confirms that this path traversal flaw can be chained with the other disclosed vulnerabilities to escalate impact.

Compensating Controls

For environments where immediate patching is not feasible:

• Place UniFi OS management interfaces on isolated VLANs or management networks that general user segments cannot reach
• Do not expose the UniFi OS management interface to the internet under any circumstances
• Monitor for unauthorized Super Admin invites, particularly accounts named unifi_support, a name identified as a hallmark of a known threat actor targeting UniFi devices
• Enable email and push notifications for security events and admin actions in the UniFi OS settings

Affected Systems and Versions

The following UniFi OS device families and version ranges are confirmed vulnerable:

UniFi OS Consoles and Gateways (versions ≤ 5.1.12): UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial, UCG-Fiber.

UniFi OS Server (versions ≤ 5.0.8): the self-hosted Linux server variant.

UDM-Beast (versions ≤ 5.1.11).

UNAS Network Attached Storage (versions ≤ 5.1.10): UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8.

Express (versions ≤ 4.0.14).

runZero's analysis notes that the path traversal flaw sits in the application layer, which makes "any host running a vulnerable version of the Network Application a potential target." UniFi devices are widely deployed in SMB, prosumer, and some enterprise environments, so the potential attack surface is substantial.

Vendor Security History

Ubiquiti's 2026 record shows a concerning run of critical-severity vulnerabilities disclosed in quick succession:

That is three major vulnerability disclosures in under three months, each with maximum or near-maximum severity CVEs, and path traversal (CWE-22) appears in every one. The pattern suggests a systemic weakness in input validation and path handling in the UniFi OS codebase rather than isolated coding errors.

CSA Singapore has issued multiple alerts about Ubiquiti vulnerabilities (AL-2026-025 and AL-2026-059), which points to government concern about the vendor's security posture. In Ubiquiti's favor, it runs a HackerOne bug bounty program that gives external researchers a reporting channel, and the coordinated disclosure for CVE-2026-47368 appears to have worked as intended.

References

• CVE-2026-47368 on NVD
• CVE-2026-47368 on CVE.org
• Ubiquiti Security Advisory Bulletin 065
• Security Advisory Bulletin 065 Community Discussion
• UniFi OS Vulnerabilities CVSS 9.9 (SecurityOnline)
• CSA Singapore Alert AL-2026-059: Multiple Critical Vulnerabilities in Ubiquiti UniFi OS
• BleepingComputer: Critical UniFi OS Bug Lets Hackers Gain Root Without Authentication
• BleepingComputer: Ubiquiti Patches Three Max Severity UniFi OS Vulnerabilities
• Field Effect: Maximum Severity UniFi OS Vulnerabilities
• runZero: UniFi Network Application Vulnerabilities
• CyCognito: Ubiquiti UniFi Network Application Path Traversal
• Reddit: PSA Security Advisory Bulletin 065
• UniFi OS Dream Machines 5.1.15 Release Notes
• UniFi OS Server 5.1.15 Release Notes
• Ubiquiti Software Downloads
• Ubiquiti Security Advisory Bulletin 064
• Truesec: Multiple Vulnerabilities in Ubiquiti UniFi Network Application