Loading vulnerability…
Command Injection in Ubiquiti UniFi OS
CVE-2026-54402 is a critical improper input validation vulnerability in Ubiquiti UniFi OS that can lead to command injection on the underlying host device. The issue affects UniFi OS and UniFi OS Server deployments, including multiple UniFi hardware platforms, in versions 5.1.15 and earlier, and is fixed in version 5.1.19. Available reporting indicates the flaw is present in user-facing administrative APIs and can be exploited remotely by an attacker who has network access and only low-privileged authenticated access. No user interaction is required. Successful exploitation allows attacker-controlled input to reach command execution paths on the host system, resulting in arbitrary command execution with high impact to confidentiality, integrity, and availability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary command execution on the host device from a low-privileged position within the UniFi OS environment. This can result in full compromise of the affected system, including unauthorized access to sensitive data, modification of system state and configuration, service disruption, installation of additional tooling, and potential privilege escalation or lateral movement depending on the host configuration and surrounding environment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting network access to UniFi OS administrative interfaces to trusted management networks only, minimizing the number of accounts with administrative or low-level management access, enforcing strong authentication, and monitoring for suspicious use of administrative APIs. Additional defensive measures include segmenting management planes, limiting east-west access to UniFi OS hosts, and validating or filtering untrusted input reaching management workflows where operationally feasible. These measures reduce exploitability but do not eliminate the underlying flaw.
Patch, then assume compromise.
Upgrade affected UniFi OS deployments to version 5.1.19 or later. This applies to UniFi OS / Server installations and affected UniFi OS-backed devices running version 5.1.15 and earlier. Where applicable, also update any related platform-specific builds identified by the vendor for NAS and EF-Core variants to fixed releases in the same advisory family. Because no reliable workaround is documented, vendor patching should be treated as the primary remediation action.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.