Quick Look: CVE-2026-47370 Command Injection in Ubiquiti UniFi OS (CVSS 9.9)

Introduction

A low-privileged user on the network can inject arbitrary commands into Ubiquiti UniFi OS devices and take complete control of the host. The flaw spans every Cloud Gateway, Dream Machine, UNVR, and self-hosted UniFi OS Server in the product line. CVE-2026-47370 carries a CVSS score of 9.9 and is one of three near-maximum-severity flaws disclosed in Ubiquiti's Security Advisory Bulletin 065. It arrived just three weeks after Bulletin 064 delivered three perfect 10.0 CVSS vulnerabilities in the same platform.

Technical information

Root cause: CWE-20 Improper Input Validation

CVE-2026-47370 is classified under CWE-20 (Improper Input Validation). UniFi OS does not properly validate or sanitize certain inputs before it places them into a system command execution context. An attacker can use this to inject and execute arbitrary operating system commands on the underlying device.

The NVD description states: "A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances."

Attack prerequisites

The exploitation requirements are minimal:

The low privilege requirement separates this flaw from the related CVE-2026-34910 in Bulletin 064, whose command injection required high privileges. That earlier flaw was still devastating, because Bishop Fox demonstrated it could be chained with CVE-2026-34908 (an authentication bypass) to remove the privilege requirement entirely. CVE-2026-47370 starts from a lower baseline, so it may be directly exploitable without an authentication bypass first.

Impact: Full host takeover

SecurityOnline characterizes the impact of CVE-2026-47370 as enabling an attacker to "completely hijack the host device, granting them absolute control over network operations." The CVSS 9.9 score reflects severe impacts across confidentiality, integrity, and availability. On a compromised UniFi OS device, that means control over routing, firewall rules, VPN configurations, and potentially lateral access to the entire managed network.

Chaining potential within Bulletin 065

CVE-2026-47370 is one of five vulnerabilities that Bulletin 065 addresses across UniFi OS and the UID Enterprise Agent:

Command injection, privilege escalation, path traversal, and improper access control in a single advisory raise serious chaining concerns. CVE-2026-47370 could be combined with CVE-2026-47368 (path traversal) or CVE-2026-47369 (privilege escalation) to do more damage than any single flaw does alone.

Lessons from Bulletin 064: Chaining works in practice

Bishop Fox security researcher John Sim published a detailed technical analysis of the Bulletin 064 vulnerabilities. It showed that CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 could be chained into a single HTTP request that gave unauthenticated root shell access. The chain worked as follows:

1. Authentication bypass (CVE-2026-34908): Nginx's authentication gateway compared the raw URI against a public route prefix while routing based on a normalized URI, so encoded traversal sequences could bypass it.
2. Path traversal (CVE-2026-34909): The traversal reached internal endpoints not intended to be externally accessible.
3. Command injection (CVE-2026-34910): The package-update endpoint interpolated an attacker-supplied package name verbatim into a shell command via an sh -c wrapper without sanitization.

The specific code path for CVE-2026-47370 has not been publicly detailed. Its structural parallels with Bulletin 064's command injection (unsanitized input reaching a system command interface in the same operating system) suggest a similar pattern. Whether it sits in the same package-update / ulp-go component or a different one is unknown.

Post-exploitation considerations

Bishop Fox's analysis of Bulletin 064 found that root access on UniFi OS exposes the JWT signing key stored in jwt.yaml. Because UniFi uses symmetric HS256 signing without algorithm pinning, an attacker with this key can forge valid admin session tokens that survive patching. The finding is specific to Bulletin 064, but it applies directly here. Any UniFi OS device compromised via CVE-2026-47370 before patching should be assumed to have had its cryptographic material exfiltrated.

Patch information

Ubiquiti has addressed CVE-2026-47370 through firmware updates documented in Security Advisory Bulletin 065, published on June 10, 2026. The vulnerability was credited to security researcher Brandon Rossi and reported through HackerOne.

The patch improves input validation to close the command injection attack vector. Because the vulnerability is in Ubiquiti's proprietary UniFi OS firmware, the fix ships as closed-source firmware updates, and no source-level code diffs or commits are publicly available.

Ubiquiti ships distinct firmware builds for each hardware line, so the fixed version depends on the device family:

The UNAS line requires version 5.1.16 (not 5.1.15), and the Express line follows its own versioning scheme (4.x rather than 5.x). Both differences come from the divergent firmware build pipelines across hardware platforms.

Ubiquiti has published individual firmware release pages for each affected product family, all linked from Bulletin 065. Updates are available through the standard Ubiquiti firmware update channels.

Post-patch actions for previously exposed systems: Treat any system that was network-accessible and unpatched before the Bulletin 065 release as potentially compromised. Bulletin 064 research demonstrated that attackers can exfiltrate JWT signing keys from compromised UniFi OS devices and forge persistent admin sessions. Organizations should therefore rotate all credentials, invalidate sessions, and run a forensic review after applying the update.

The UID Enterprise Agent also needs an update, to version 1.61.4 or later, to address CVE-2026-47367. Applying only the UniFi OS update leaves that separate command injection vulnerability unaddressed.

Affected systems and versions

CVE-2026-47370 affects the entire UniFi hardware console line running UniFi OS. The vulnerable version ranges are:

UniFi OS 5.x devices (most of the product line):

• UDM, UDM Pro, UDM SE, UDM Pro Max: versions 5.1.12 and earlier
• UDM Beast: versions 5.1.11 and earlier
• Enterprise Fortress Gateway (EFG), UDW: versions 5.1.12 and earlier
• UDR, UDR7, UDR 5G: versions 5.1.12 and earlier
• Express 7: versions 5.1.12 and earlier
• UCK, UCKP, UCK Enterprise (Cloud Keys): versions 5.1.12 and earlier
• UNVR, UNVR Pro, UNVR Instant, UNVR G2, UNVR G2 Pro: versions 5.1.12 and earlier
• ENVR, ENVR Core: versions 5.1.12 and earlier
• UCG Ultra, UCG Max, UCG Industrial, UCG Fiber (Cloud Gateways): versions 5.1.12 and earlier

UNAS devices:

• UNAS 2, UNAS 4, UNAS Pro, UNAS Pro 4, UNAS Pro 8: versions 5.1.10 and earlier

Express:

• Express: versions 4.0.14 and earlier

UniFi OS Server (self-hosted):

• Versions 5.0.8 and earlier

Vendor security history

Ubiquiti's recent advisories show critical vulnerabilities concentrated in the UniFi OS platform over a short period:

Three critical advisories in a three-month window, each with remotely exploitable vulnerabilities at or near maximum severity, point to a systemic weakness in how UniFi OS handles input sanitization across its components rather than isolated coding errors. The recurring vulnerability types (improper input validation leading to command injection, path traversal enabling further access, privilege escalation) suggest these issues share common architectural roots.

Ubiquiti runs a coordinated vulnerability disclosure program through HackerOne, which is good security practice. Still, the frequency and severity of recent disclosures indicate that the platform's security architecture needs deeper investment in secure development, particularly around input validation and command execution paths.

References

• NVD: CVE-2026-47370
• Ubiquiti Security Advisory Bulletin 065
• Security Advisory Bulletin 065 Community Discussion
• SecurityOnline: Critical 9.9 CVSS Ubiquiti UniFi OS Vulnerabilities Exposed
• Bishop Fox: Popping Root on UniFi OS Server: Unauthenticated RCE Chain Detection Analysis
• Reddit PSA: Security Advisory Bulletin 065
• Ubiquiti Security Advisory Bulletin 064
• BleepingComputer: Ubiquiti patches three max severity UniFi OS vulnerabilities
• Singapore CSA: Multiple Vulnerabilities in Ubiquiti UniFi Network Application
• Truesec: Multiple Vulnerabilities in Ubiquiti UniFi Network Application
• OpenCVE: Ubiquiti CVEs and Security Vulnerabilities