Loading vulnerability…
Authenticated command injection in Ubiquiti UniFi OS
CVE-2026-33000 is an improper input validation vulnerability in Ubiquiti UniFi OS, confirmed in UniFi OS Server 5.0.6 and earlier. An attacker with network access and high privileges can inject operating system commands through the package-update handler. The handler incorporates an attacker-controlled package name into a command executed through a shell without adequate sanitization. Exploitation requires a valid authentication token with view:identity:update permission. The same command injection sink, when reached through a separate authentication-gateway bypass, is tracked as CVE-2026-34910.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary operating system command execution. On the tested vulnerable server, the shared command injection sink executes as the ucs-update service account, whose passwordless sudo permissions permit further escalation to root. Root compromise can expose configuration data, credentials, signing keys, and other stored secrets, and enable unauthorized changes and persistence. Root access is a potential subsequent escalation outcome rather than the immediate execution context of the injection.
If you can’t patch tonight, do this now.
Restrict management interfaces to trusted administrative networks or dedicated management VLANs, require VPN access for remote administration, and avoid direct public-internet exposure. Monitor for anomalous update-service activity and unauthorized administrative changes. These measures reduce exposure but do not replace upgrading.
Patch, then assume compromise.
Upgrade UniFi OS Server to version 5.0.8 or later. The fixed release validates package names, replaces shell-based execution with argument-array execution, and partially hardens the update service account's sudo permissions. Apply the product-specific fixed releases specified in Ubiquiti Security Advisory Bulletin 064 to other affected deployments. If compromise is suspected, investigate for persistence and rotate exposed credentials and cryptographic secrets; patching alone does not invalidate stolen signing keys or remove an existing compromise.
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.