Brief Summary: CVE-2026-47369 UniFi OS Privilege Escalation via Improper Input Validation (CVSS 9.9)

Introduction

A low-privileged user on the same network as a Ubiquiti UniFi OS device can exploit an input validation flaw to escalate their privileges on the appliance. A companion path traversal vulnerability can be chained to remove even that low-privilege requirement entirely. CVE-2026-47369 (CVSS 9.9) is one of three critical vulnerabilities disclosed in Ubiquiti's Security Advisory Bulletin 065, continuing a pattern of quarterly critical advisories against the UniFi OS platform that began in March 2026.

Ubiquiti's networking equipment is widely deployed across small and mid-sized businesses, ISPs, managed service providers, and a large enthusiast community. The company generated $2.574B in annual revenue in 2025. Because of that broad install base, and because the appliances typically sit at the network edge, any critical UniFi OS vulnerability is a high-priority patching event.

Technical Information

Root Cause: CWE-20 Improper Input Validation

The NVD description of this CWE-20 flaw states: "A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances."

The full CVSS 3.1 vector string is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which breaks down as follows:

The "Scope: Changed" designation means successful exploitation lets the attacker affect resources beyond the security scope of the vulnerable component itself. That fits a privilege escalation that grants control over the entire UniFi OS device or instance.

What We Know About the Attack Flow

Neither Ubiquiti nor the researcher who discovered the flaw has publicly disclosed its specific mechanism, including which input field, API endpoint, or protocol is vulnerable. The advisory and surrounding context establish the following:

1. Entry point: The attacker needs network access to the UniFi OS device and a low-privilege authenticated session. In many UniFi deployments, this could be any user with a basic account on the management interface.

2. Exploitation: The attacker submits crafted input that UniFi OS fails to validate properly, which triggers a privilege escalation. The low attack complexity and the absence of any user interaction requirement indicate a straightforward exploitation path.

3. Outcome: The attacker gains elevated privileges on the UniFi OS device. The advisory does not specify the exact privilege level attainable (root, admin, or an intermediate role), but CVSS impact scores of High across all three categories suggest full system compromise is achievable.

Chaining Context

CVE-2026-47368, a path traversal vulnerability also patched in this bulletin, changes the risk calculus significantly. The advisory notes that it "can be chained with other vulnerabilities to eliminate the requirement for low-privileged access." Chained together, CVE-2026-47368 and CVE-2026-47369 could be exploitable by a completely unauthenticated network attacker, which removes the one meaningful barrier to exploitation.

Bulletin 065 also includes CVE-2026-47367, a command injection flaw in the UID Enterprise Agent scoring CVSS 9.9. The advisory distinguishes CVE-2026-47369 (privilege escalation) from its sibling CVE-2026-47370, which shares the same improper input validation root cause but enables command injection instead. Together, the four CVEs present a broad attack surface for chaining.

There is precedent for this kind of chain. BleepingComputer previously reported that the three vulnerabilities from Bulletin 064 (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, all CVSS 10.0) had been shown to chain into unauthenticated remote code execution with root privileges on UniFi OS. Bulletin 065 flaws could plausibly be chained the same way, though no such chain has been publicly demonstrated as of the publication date.

Patch Information

Ubiquiti fixed CVE-2026-47369 with a firmware-level patch disclosed in Security Advisory Bulletin 065, published on June 10, 2026. UniFi OS is proprietary, closed-source firmware, so there are no public source code diffs or commit-level changes to inspect. The fix ships only through official firmware updates.

The fixed versions vary by device family:

The UNAS line requires version 5.1.16 (not 5.1.15), which bundles UniFi Drive 4.2.2. All other product lines received 5.1.15 builds simultaneously.

A single firmware update addresses the full chaining risk. It resolves both CVE-2026-47369 and the companion CVE-2026-47368 (the path traversal that eliminates the low-privilege requirement), so organizations should not treat them as separate patching events.

The Canadian Centre for Cyber Security published advisory AV26-589 on June 11, 2026, which confirms that these vendor patches are available.

The vulnerability was credited to security researcher Brandon Rossi (also known as @0xConda), who reported it through Ubiquiti's HackerOne coordinated vulnerability disclosure program.

Affected Systems and Versions

According to the advisory, the following device families are affected when running UniFi OS versions earlier than the patched releases:

Gateway and Console Devices (vulnerable below UniFi OS 5.1.15): UDM, UDM Pro, UDM SE, UDM Pro Max, UDM Beast, EFG, UDW, UDR, UDR7, UDR 5G, Express 7, UCG Ultra, UCG Max, UCG Industrial, UCG Fiber

Cloud Key Devices (vulnerable below UniFi OS 5.1.15): UCK, UCKP, UCK Enterprise

NVR Devices (vulnerable below UniFi OS 5.1.15): UNVR, UNVR Pro, UNVR Instant, ENVR, ENVR Core, UNVR G2, UNVR G2 Pro

UniFi OS Server (vulnerable at version 5.0.8 and earlier)

NAS Devices (vulnerable below version 5.1.16): UNAS 2, UNAS 4, UNAS Pro, UNAS Pro 4, UNAS Pro 8

Express Appliances (vulnerable below version 4.0.15)

A separate vulnerability in the same bulletin, CVE-2026-47367, affects the UID Enterprise Agent, which requires an upgrade to version 1.61.4 or later.

Vendor Security History

Ubiquiti's security record in 2026 shows a concentrated run of critical disclosures:

Three critical bulletins in a single quarter, with recurring themes of improper input validation and inadequate access control, suggest systemic weaknesses in the UniFi OS platform layer rather than isolated bugs. TrueSec has also noted that state-sponsored groups have increasingly targeted Ubiquiti devices for botnet operations against U.S. and allied networks, which makes fast patching more urgent.

Organizations running Ubiquiti infrastructure should set up a standing workflow for rapid UniFi OS patching. Based on the 2026 cadence, critical advisories are arriving approximately monthly.

References

• NVD: CVE-2026-47369
• Ubiquiti Security Advisory Bulletin 065
• Security Advisory Bulletin 065 Community Discussion
• SecurityOnline: Critical 9.9 CVSS Ubiquiti UniFi OS Vulnerabilities Exposed
• Ubiquiti Firmware Release Tracker
• Canadian Centre for Cyber Security Advisory AV26-589
• BleepingComputer: Critical UniFi OS Bug Lets Hackers Gain Root Without Authentication
• TrueSec: Multiple Vulnerabilities in Ubiquiti UniFi Network Application
• Reddit PSA: Security Advisory Bulletin 065
• Proofpoint: 2026 Vulnerability Exploitation in the Wild
• CISA Known Exploited Vulnerabilities Catalog
• Ubiquiti Security Advisory Bulletin 064
• Ubiquiti Security Advisory Bulletin 062