Loading vulnerability…
Privilege Escalation in Ubiquiti UniFi OS
CVE-2026-47369 is a critical improper input validation vulnerability in Ubiquiti UniFi OS that allows privilege escalation on affected devices or instances. The flaw is exploitable by an attacker with network access and low-privileged access to the target UniFi OS system, and is scored CVSS v3.1 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Publicly available information identifies the weakness class as CWE-20 but does not disclose the specific vulnerable endpoint, parameter, function, or protocol handler. Successful exploitation enables escalation from a low-privileged context to higher privileges within the UniFi OS environment. The issue was disclosed in Security Advisory Bulletin 065 and may be especially dangerous when chained with the related path traversal vulnerability CVE-2026-47368, which can remove the low-privilege prerequisite.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can give an attacker elevated privileges within the affected UniFi OS device or instance, with high impact to confidentiality, integrity, and availability. In practical terms, privilege escalation at this level can enable broader administrative control over the appliance, access to sensitive data and configuration, unauthorized system changes, disruption of services, and potentially serve as a stepping stone to full device compromise when combined with other vulnerabilities.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of UniFi OS management interfaces to trusted administrative networks only, enforce strict network segmentation, and prevent access from untrusted or shared segments. Because exploitation requires network reachability, limiting management-plane exposure can materially reduce risk. Given the possibility of exploit chaining with related Bulletin 065 vulnerabilities, internet exposure and unnecessary lateral reachability to UniFi OS devices should be eliminated until patches are applied.
Patch, then assume compromise.
Apply the vendor fixes from Security Advisory Bulletin 065. Available information indicates that affected gateway, console, Cloud Key, NVR, and UniFi OS Server deployments are remediated in UniFi OS 5.1.15 or later; UNAS devices are remediated in 5.1.16 or later; and Express appliances are remediated in 4.0.15 or later. Systems running vulnerable earlier releases should be upgraded promptly to the appropriate fixed version for their product family.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.