CVE-2026-95861: UniFi Gateway DOS Vulnerability

CVE-2026-95861 Overview

CVE-2026-95861 is an uncontrolled recursion vulnerability [CWE-674] affecting certain Ubiquiti UniFi gateway devices. An unauthenticated attacker with network access to a vulnerable device can trigger recursive processing that exhausts device resources. The result is a Denial of Service (DoS) condition that renders the gateway unresponsive.

Ubiquiti disclosed the issue in Security Advisory Bulletin 069. The vulnerability does not affect data confidentiality or integrity, but availability impact is high because gateway devices route traffic for entire network segments.

Critical Impact
An unauthenticated network attacker can crash or hang UniFi gateway devices, disrupting connectivity for all downstream clients until the device is restarted or restored.

Affected Products

Ubiquiti UniFi gateway devices (specific models identified in the Ubiquiti Security Advisory Bulletin)
Refer to vendor advisory for confirmed firmware versions
Networks using affected UniFi gateways as perimeter or routing devices

Discovery Timeline

2026-09-22 - CVE-2026-95861 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95861

Vulnerability Analysis

The vulnerability is classified under [CWE-674] Uncontrolled Recursion. Affected firmware fails to enforce a bound on recursive function invocations when processing certain network-supplied input. Each recursive call consumes stack space, and without a termination condition or depth limit, the process eventually exhausts available memory or triggers a stack overflow.

Exploitation requires only network reachability to a service exposed by the gateway. No authentication is required, and no user interaction is needed. The attacker sends crafted input that drives the recursive code path until the responsible process terminates or the device becomes unresponsive.

Gateway devices are high-value DoS targets. When the gateway fails, downstream clients lose routing, DNS, DHCP, and firewall services until the device recovers.

Root Cause

The root cause is missing recursion depth validation in a network-accessible parser or handler on the UniFi gateway firmware. Ubiquiti's advisory does not publicly identify the specific component, but CWE-674 patterns typically involve nested data structures, protocol messages, or configuration blobs where the parser recurses per nesting level without a maximum-depth check.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends specially crafted packets or protocol messages to a service exposed on the UniFi gateway. The malformed input drives a recursive processing loop that consumes stack or memory until the process crashes. Repeated requests can keep the device offline. Full exploitation details are available in the Ubiquiti Security Advisory Bulletin 069.

Detection Methods for CVE-2026-95861

Indicators of Compromise

Unexpected reboots, crashes, or watchdog resets on UniFi gateway devices
Loss of routing, DHCP, or DNS services for downstream clients without configuration changes
Elevated CPU or memory utilization on the gateway preceding a crash
Bursts of malformed or deeply nested protocol traffic directed at the gateway management or service ports

Detection Strategies

Monitor UniFi controller logs and device syslog for repeated process restarts or kernel panic messages
Baseline gateway uptime and alert on unexpected reboots that correlate with inbound traffic spikes
Inspect network flow telemetry for unusual traffic patterns targeting gateway service ports from untrusted sources

Monitoring Recommendations

Forward UniFi device logs to a centralized SIEM for correlation with network telemetry
Alert on availability drops for gateway-hosted services such as DHCP leases and WAN connectivity
Track firmware versions across the UniFi fleet to identify unpatched devices exposed to the network

How to Mitigate CVE-2026-95861

Immediate Actions Required

Apply the firmware update referenced in Ubiquiti Security Advisory Bulletin 069 to all affected UniFi gateway devices
Restrict management and service interfaces on gateway devices to trusted network segments only
Block untrusted inbound access to non-essential services exposed by the gateway
Inventory UniFi gateways and confirm firmware versions against the vendor advisory

Patch Information

Ubiquiti has published fixed firmware for affected UniFi gateway devices. Refer to the Ubiquiti Security Advisory Bulletin 069 for the exact device models and firmware versions that remediate CVE-2026-95861. Deploy the patched firmware through the UniFi Network application or direct device update as soon as maintenance windows allow.

Workarounds

Limit exposure of the gateway's management and service ports to trusted administrative networks using upstream firewall rules
Apply rate limiting or access control lists at perimeter devices to reduce the likelihood of DoS traffic reaching the gateway
Segment critical services behind redundant gateways so that a single device failure does not disrupt the entire network
Where feasible, disable network-exposed services that are not required for operations

bash

# Example: restrict UniFi gateway management access to a trusted admin subnet
# Apply on an upstream firewall in front of the affected gateway
iptables -A FORWARD -p tcp -d <gateway_ip> --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <gateway_ip> --dport 443 -j DROP
iptables -A FORWARD -p tcp -d <gateway_ip> --dport 22  -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <gateway_ip> --dport 22  -j DROP