CVE-2026-47369: UniFi OS Privilege Escalation Vulnerability

CVE-2026-47369 Overview

CVE-2026-47369 is an improper input validation vulnerability ([CWE-20]) affecting certain devices running Ubiquiti UniFi OS. An authenticated attacker with low privileges and network access can exploit the flaw to escalate privileges within affected UniFi OS devices or instances. The issue carries a CVSS 3.1 base score of 9.9 with a scope change, indicating that successful exploitation impacts resources beyond the initially vulnerable component.

The vulnerability was published to the National Vulnerability Database on 2026-06-12 and last updated on 2026-06-17. Ubiquiti has issued guidance through its community security advisory channel.

Critical Impact
A network-adjacent attacker with low-privileged credentials can gain administrative control of UniFi OS devices, exposing managed network infrastructure to full compromise.

Affected Products

Ubiquiti UniFi OS — specific affected device models and firmware versions are listed in the vendor advisory
UniFi OS-managed network instances (cloud-managed and on-premises consoles)
Downstream UniFi devices managed by an exploited UniFi OS console

Discovery Timeline

2026-06-12 - CVE-2026-47369 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47369

Vulnerability Analysis

The vulnerability stems from improper input validation in UniFi OS, classified under [CWE-20]. An authenticated attacker who can reach the device over the network and holds low-privileged credentials can supply crafted input that the underlying logic fails to sanitize or constrain. Because the affected component runs with higher privileges than the requesting user, the malformed input is processed in a privileged context.

Successful exploitation grants the attacker elevated privileges on the UniFi OS device or instance. The CVSS scope change indicates that exploitation crosses a trust boundary, meaning impact extends to additional resources such as managed UniFi devices, configuration stores, and network services controlled by the console.

Confidentiality, integrity, and availability are all rated high. An attacker who gains administrative control can read sensitive configuration data, modify firewall and routing rules, alter VLAN segmentation, and disrupt service availability for the entire managed network.

Root Cause

The root cause is the absence of, or insufficient enforcement of, input validation on a privileged code path. The affected handler accepts data from a lower-privileged authenticated user without verifying its structure, range, or semantic correctness before acting on it. This permits the attacker to influence privileged operations and escape the authorization boundary intended for low-privileged accounts.

Attack Vector

Exploitation requires network access to the UniFi OS management interface and valid low-privileged credentials. No user interaction is required, and attack complexity is low. Attackers commonly obtain low-privileged accounts through credential reuse, phishing, or compromise of read-only operator accounts that are often shared across teams.

No public proof-of-concept exploit has been observed at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics of the vulnerable input handler are described in the UI Community Security Advisory.

Detection Methods for CVE-2026-47369

Indicators of Compromise

Unexpected privilege changes or new administrator accounts created on UniFi OS consoles
Authentication events from low-privileged accounts immediately followed by configuration changes that require admin rights
Anomalous API calls to UniFi OS management endpoints containing malformed or oversized parameters
Outbound connections from UniFi OS devices to untrusted destinations following suspicious admin logins

Detection Strategies

Audit UniFi OS administrative action logs for privilege escalations not preceded by an explicit admin authentication
Compare current device configurations against a known-good baseline to detect unauthorized changes to firewall, VPN, or VLAN settings
Alert on role or permission modifications performed within short time windows after low-privileged session activity

Monitoring Recommendations

Forward UniFi OS syslog and audit events to a centralized SIEM for correlation across devices
Monitor management-plane network traffic for connections originating from unexpected subnets or hosts
Track firmware versions across the UniFi fleet to confirm patch deployment status

How to Mitigate CVE-2026-47369

Immediate Actions Required

Apply the firmware update specified in the UI Community Security Advisory to all UniFi OS devices
Restrict management-interface access to a dedicated administrative VLAN or VPN
Rotate credentials for all low-privileged and administrative UniFi OS accounts
Review existing user roles and remove unused or shared low-privileged accounts

Patch Information

Ubiquiti has issued a security advisory and corresponding firmware update through the UI Community portal. Administrators should consult the vendor advisory for the exact fixed versions that correspond to their UniFi OS hardware model and deployment type. Apply the update across all affected consoles before exposing management interfaces to untrusted networks.

Workarounds

Block network access to UniFi OS management ports from untrusted networks using upstream firewall rules
Enforce multi-factor authentication on every UniFi OS account, including read-only operators
Disable or remove low-privileged accounts that are not actively required for operations until patching is complete

bash

# Configuration example: restrict UniFi OS management access at the network edge
# Replace MGMT_SUBNET and CONSOLE_IP with your environment values
iptables -A FORWARD -p tcp -s MGMT_SUBNET -d CONSOLE_IP --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d CONSOLE_IP --dport 443 -j DROP