Brief Summary: CVE-2026-48610 Improper Access Control in Ubiquiti UniFi OS Cloud Gateways

Introduction

Ubiquiti's UniFi OS Cloud Gateways and Dream Machines are the central management plane for thousands of network deployments, so an access control bypass on these devices leads directly to unauthorized infrastructure changes. CVE-2026-48610, disclosed on June 12, 2026 as part of Ubiquiti Security Advisory Bulletin 065, is a CVSS 8.1 improper access control flaw that allows a network-adjacent attacker to modify device configurations without authorization. It comes in a run of three consecutive critical security bulletins for the same platform in under three months.

Technical Information

Root Cause and Classification

CVE-2026-48610 is classified under CWE-284 (Improper Access Control), the weakness category for failures to properly enforce permissions, privileges, or other security features that limit what users or processes can do. The CNA-assigned CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, which gives a score of 8.1 (High). As of the NVD publication date, NIST has not yet provided its own independent CVSS assessment.

The vulnerability is in the UniFi OS firmware on Ubiquiti's Cloud Gateway and Dream Machine product families. Per the NVD entry and Ubiquiti's advisory, "under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices."

Attack Vector Analysis

The vector specifies AC:H (Attack Complexity: High), which means exploitation depends on conditions beyond the attacker's control. The advisory's phrase "under certain network configurations" points the same way. Not all deployments are equally vulnerable, and specific setup conditions may raise or lower exploitability. Ubiquiti has not publicly disclosed which configurations increase risk.

PR:N (Privileges Required: None) means the attacker does not need any authenticated session or credentials on the target device to exploit the flaw. Combined with AV:N (Network attack vector), this makes the vulnerability accessible to any attacker who can reach the device over the network, whether from an adjacent VLAN, a shared VPN segment, a guest Wi-Fi network, or a compromised peer device on the same LAN.

Community analysis on Reddit clarified that the Bulletin 065 vulnerabilities require local network access to exploit and lack direct remote execution capability. That separates them from the earlier Bulletin 064 vulnerabilities, which allowed unauthenticated remote code execution with CVSS 10.0 scores. The effective attack surface may still be broader than a simple "physical LAN" reading suggests if management interfaces are reachable across network boundaries.

Impact

The vector rates all three CIA triad dimensions High, so confidentiality, integrity, and availability are all fully impacted. In network devices, CWE-284 vulnerabilities typically let an attacker:

• Modify device configurations and security policies
• Alter or create administrative accounts
• Reconfigure network settings (firewall rules, routing, VLAN assignments)
• Potentially disrupt device availability

Exploitation Mechanism

Neither Ubiquiti nor the researcher who discovered the flaw has publicly detailed the exact technical mechanism, but the CWE-284 classification and the CVSS vector narrow the possibilities. The vulnerability likely involves bypassing role-based access controls, API authentication checks, or session management on the UniFi OS management interface. An attacker who can reach the device over the network could use this bypass to issue configuration changes that would normally require administrative authentication.

Chaining Considerations

This vulnerability was disclosed alongside four other flaws in Bulletin 065:

The bulletin explicitly warns that CVE-2026-47368 (the path traversal flaw) can be chained with other vulnerabilities to bypass authentication requirements. That matches what has happened before. BleepingComputer reported that attackers previously chained three Bulletin 064 vulnerabilities in UniFi OS to execute remote code with root privileges without authentication. Given that precedent, CVE-2026-48610 could be one step in a multi-step attack chain, and the total impact could go well beyond what the 8.1 score alone suggests.

CVSS Scoring Note

The 8.1 CVSS score comes from the CNA (the submitter), not from NIST's independent analysis. The NVD entry notes "NVD assessment not yet provided." Administrators should monitor the NVD page for updated scoring as NIST completes its review.

Patch Information

Ubiquiti addressed CVE-2026-48610 through firmware updates detailed in Security Advisory Bulletin 065, published on June 10, 2026. Because UniFi OS is proprietary firmware, there are no public source code commits or diffs to inspect. Ubiquiti delivered the fix only through over-the-air (or manually applied) firmware upgrades.

This CVE affects fewer devices than some of the other vulnerabilities in the same bulletin. Only Ubiquiti's Cloud Gateway and Dream Machine product families are affected. The Cloud Keys, NVRs, NAS devices, and the standalone Express are not. The exact affected product list and patched firmware versions are:

The release notes for UniFi OS Cloud Gateways 5.1.15 explicitly confirm the fix with the entry "Fixed the security issues mentioned in Security Advisory Bulletin 065." Version 5.1.15 also bundled UniFi Network 10.4.57, improved system stability, and fixed unrelated bugs in DNS over IPv6 and WAN DHCP handling.

Firmware version 5.1.15 is a composite security release that covers the entire attack surface disclosed in Bulletin 065, including two CVSS 9.9 command injection and privilege escalation flaws and an 8.6 path traversal vulnerability that can be chained to bypass authentication. That makes the upgrade particularly urgent. Administrators should check the UniFi OS dashboard or the Ubiquiti mobile app to confirm that version 5.1.15 (or later) is active.

Compensating controls while patches are being deployed:

Affected Systems and Versions

CVE-2026-48610 affects Ubiquiti's Cloud Gateway and Dream Machine product families running UniFi OS. The specific affected devices and version ranges are:

Vulnerable at version 5.1.12 and earlier:

• UDM (UniFi Dream Machine)
• UDM-Pro
• UDM-SE
• UDM-Pro-Max
• EFG
• UDW
• UDR
• UDR7
• UDR-5G
• Express 7
• UCG-Ultra
• UCG-Max
• UCG-Industrial
• UCG-Fiber

Vulnerable at version 5.1.11 and earlier:

• UDM-Beast

Not affected by this specific CVE (though affected by other Bulletin 065 vulnerabilities):

• Cloud Keys (UCK, UCKP, UCK-Enterprise)
• NVR devices
• NAS devices
• Standalone Express

UniFi OS version 5.1.15 or later remediates all listed devices.

The vulnerability is configuration dependent. The advisory states that exploitation requires "certain network configurations," though Ubiquiti has not specified which configurations increase exposure. Deployments where management interfaces are reachable from untrusted network segments (guest Wi-Fi, shared VPNs, insufficiently segmented VLANs) carry higher risk.

Vendor Security History

Ubiquiti's security posture in 2026 has drawn significant concern from the security community. The company has published at least three Security Advisory Bulletins for critical vulnerabilities in about three months:

The OpenCVE database lists at least 31 CVEs attributed to Ubiquiti across its product lines, with multiple CVSS 10.0 entries. Maximum-severity vulnerabilities in core platform software, arriving in rapid succession, suggest systemic weaknesses in Ubiquiti's secure development lifecycle, particularly around input validation and access control enforcement.

Beyond the 2026 bulletins, Ubiquiti has a history of significant security issues, including legacy CVEs from 2019 involving weak AES-CBC encryption (CVE-2019-25651, CVSS 8.3) and improper certificate verification in SMTP connections (CVE-2019-25652, CVSS 7.5). Earlier product lines, including airMAX, UBB, and UniFi Play, have also had remote code execution vulnerabilities.

State-sponsored threat actors have specifically targeted Ubiquiti devices. In February 2024, the FBI dismantled a botnet of compromised Ubiquiti Edge OS routers operated by Russia's GRU (Unit 26165) for proxying malicious traffic against the United States and allied nations.

Users on the r/UNIFI subreddit have reported difficulty accessing official security bulletins on Ubiquiti's community platform, with persistent errors on the community.ui.com pages. Multiple users were frustrated by unreliable security notification emails, which delay administrator awareness and effectively extend the window of exposure. Some users have reported isolating devices from cloud management entirely, and others described the cloud-connected architecture as a "total security disaster."

References

• CVE-2026-48610 Detail, NVD
• Security Advisory Bulletin 065, Ubiquiti Community
• UniFi OS Cloud Gateways 5.1.15 Release Notes
• PT Security Vulnerability Database: PT-2026-48825
• Security Advisory Bulletin 065 Discussion, Ubiquiti Community
• Reddit r/UNIFI: PSA Security Advisory Bulletin 065
• TrueSec: Multiple Vulnerabilities in Ubiquiti UniFi Network Application
• Security Advisory Bulletin 064, Ubiquiti Community
• Security Advisory Bulletin 062, Ubiquiti Community
• Cyber Security Agency of Singapore: Multiple Vulnerabilities in Ubiquiti UniFi Network Application
• OpenCVE: Ubiquiti CVEs and Security Vulnerabilities
• OpenText Cybersecurity: Critical UniFi OS Bug Lets Hackers Gain Root Without Authentication