Loading vulnerability…
Command Injection in Ubiquiti UniFi OS
CVE-2026-47370 is a critical improper input validation vulnerability in Ubiquiti UniFi OS that allows command injection on affected devices and instances. The flaw arises because UniFi OS does not properly validate or sanitize certain attacker-controlled input before incorporating it into a system command execution context. A malicious actor with network access and low privileges can exploit the issue without user interaction to execute arbitrary operating system commands on the target. Public reporting indicates the vulnerability affects multiple UniFi OS product families, including gateways, consoles, NVR appliances, UniFi OS Server, NAS devices, and Express appliances running vulnerable releases. The issue was disclosed in Ubiquiti Security Advisory Bulletin 065 and is associated with a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary command execution on the underlying UniFi OS host, which can lead to complete takeover of the affected device or instance. Because the CVSS metrics indicate high impact to confidentiality, integrity, and availability, an attacker may be able to access sensitive data, alter configurations and security controls, install additional tooling, disrupt services, and operate with elevated influence over the appliance. Reporting also notes that this vulnerability may be chained with related UniFi OS flaws to broaden the effective attack surface or remove the low-privilege prerequisite in multi-step attacks.
If you can’t patch tonight, do this now.
Until patching is completed, restrict access to UniFi OS management interfaces to trusted administrative networks only, enforce strong network segmentation, and avoid exposing management services to untrusted segments or the internet. Limit reachable paths to the device from guest networks, shared VPN segments, and other less-trusted environments. Where exposure may have occurred, increase monitoring for unauthorized administrative activity and investigate affected systems for signs of compromise.
Patch, then assume compromise.
Apply the vendor fixes from Ubiquiti Security Advisory Bulletin 065. Reported fixed versions are UniFi OS 5.1.15 or later for most affected UniFi OS devices and UniFi OS Server, UniFi OS 5.1.16 or later for UNAS devices, and UniFi OS 4.0.15 or later for Express devices. Systems previously exposed while unpatched should be treated as potentially compromised, with post-patch response actions including credential rotation, session invalidation, and forensic review as appropriate.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.