Loading vulnerability…
CVE-2026-47368 is a path traversal vulnerability in certain devices running Ubiquiti UniFi OS. The flaw is caused by insufficient validation of file path input in the UniFi OS application layer, allowing an attacker to supply directory traversal sequences and access files outside the intended directory scope. Successful exploitation allows a network-accessible attacker to read data from affected UniFi OS devices or instances. Public reporting indicates the issue affects a broad set of UniFi OS product families and that it was addressed in Ubiquiti Security Advisory Bulletin 065. The vulnerability is primarily an arbitrary file-read issue with direct confidentiality impact, but it is also notable because it can be chained with other UniFi OS vulnerabilities disclosed in the same bulletin to remove authentication or privilege prerequisites and contribute to broader compromise.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity path traversal vulnerability that allows remote attackers to extract sensitive data from affected operational instances.
A path traversal vulnerability in certain devices running UniFi OS that could allow a network-accessible attacker to obtain data from affected UniFi OS devices or instances.
A path traversal vulnerability in Ubiquiti UniFi OS that allows a network-adjacent attacker to read arbitrary files from affected devices and may be chained with other Bulletin 065 flaws to achieve broader compromise.
A path traversal vulnerability in UniFi OS that can be chained with other flaws, including CVE-2026-47369, to remove the low-privilege authentication requirement and enable unauthenticated exploitation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.