CVE-2026-47367 Overview
CVE-2026-47367 is a command injection vulnerability in Ubiquiti's UID Enterprise Agent. The flaw stems from improper input validation [CWE-20] in the agent's request handling logic. An authenticated attacker with low privileges on the network can inject arbitrary operating system commands that execute on the host device.
The issue is tracked through Ubiquiti's security advisory bulletin and affects deployments of the UID Enterprise Agent. Because the vulnerability allows execution on the underlying host with a changed security scope, successful exploitation can lead to full device compromise and lateral movement.
Critical Impact
Network-adjacent attackers with low privileges can execute arbitrary commands on the host, leading to confidentiality, integrity, and availability loss with scope change.
Affected Products
- Ubiquiti UID Enterprise Agent (see vendor advisory for affected versions)
- Host systems running the vulnerable UID Enterprise Agent build
- Networked environments where the agent is reachable by low-privileged users
Discovery Timeline
- 2026-06-12 - CVE-2026-47367 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-47367
Vulnerability Analysis
The UID Enterprise Agent accepts input from authenticated clients over the network and passes it to a system-level command handler without sufficient sanitization. Because validation is missing or incomplete, attacker-supplied metacharacters reach a shell or command execution function unchanged.
The CVSS vector indicates the agent is reachable across the network, requires low privileges, and needs no user interaction. The scope changes during exploitation, meaning the agent process can affect components outside its original security authority. This pattern is consistent with command injection that pivots from an application context to the host operating system.
The vulnerability is categorized under [CWE-20] Improper Input Validation. The downstream behavior matches a classic OS command injection pattern, where attacker-controlled strings are concatenated into commands executed by the agent.
Root Cause
The root cause is missing input validation on parameters that the UID Enterprise Agent forwards to command execution routines. Without an allowlist or proper escaping, shell metacharacters such as ;, |, &, and backticks alter the intended command structure and inject additional operations.
Attack Vector
An attacker authenticates with low-privilege credentials and submits a crafted request to a network-exposed agent endpoint. The malicious payload embeds shell metacharacters inside an otherwise legitimate parameter. The agent processes the request, invokes the command handler, and executes the injected commands on the host with the agent's privileges.
No verified public proof-of-concept code is currently available. Refer to the UI Community Security Advisory for vendor-supplied technical details.
Detection Methods for CVE-2026-47367
Indicators of Compromise
- Unexpected child processes spawned by the UID Enterprise Agent process, especially shells such as sh, bash, cmd.exe, or powershell.exe.
- Outbound network connections from the agent host to unfamiliar IP addresses immediately after authenticated agent requests.
- New or modified files in agent working directories, including scripts, binaries, or persistence artifacts.
- Authentication logs showing low-privileged accounts issuing administrative or unusual API calls to the agent.
Detection Strategies
- Monitor process lineage for the UID Enterprise Agent and alert on any spawned interpreter or system utility used for reconnaissance such as whoami, id, uname, or net.
- Inspect agent request payloads at the network layer for shell metacharacters like ;, |, &&, backticks, and $() in parameter values.
- Correlate authenticated agent activity from low-privileged accounts with subsequent host-level command execution events.
Monitoring Recommendations
- Enable verbose logging on the UID Enterprise Agent and ship logs to a centralized analytics platform for retention and correlation.
- Track baseline behavior of the agent process and alert on deviations such as new outbound connections, unusual CPU usage, or off-hours activity.
- Audit all accounts permitted to interact with the agent and review access patterns weekly.
How to Mitigate CVE-2026-47367
Immediate Actions Required
- Apply the patched UID Enterprise Agent version published in the UI Community Security Advisory as soon as it is available in your environment.
- Restrict network access to the agent so only trusted management hosts can reach its listening ports.
- Rotate credentials for any account that can authenticate to the UID Enterprise Agent.
- Review host process and authentication logs for signs of prior exploitation.
Patch Information
Ubiquiti has published remediation guidance through the UI Community Security Advisory. Administrators should consult that bulletin for the fixed version of the UID Enterprise Agent and follow the documented upgrade procedure. No vendor workaround should be considered a substitute for the official patch.
Workarounds
- Place the UID Enterprise Agent behind a firewall or management VLAN that blocks access from general user networks.
- Enforce least privilege on accounts that can authenticate to the agent and remove unnecessary access.
- Deploy host-based monitoring on systems running the agent to detect unexpected command execution.
- Disable or stop the UID Enterprise Agent on hosts where it is not actively required until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
