CVE-2026-95862: UniFi Gateway Out-of-bounds Write DoS Flaw

CVE-2026-95862 Overview

CVE-2026-95862 is an out-of-bounds write vulnerability [CWE-787] affecting certain Ubiquiti UniFi gateway devices. A network-adjacent attacker can exploit the flaw to trigger a Denial of Service (DoS) condition on the affected device. The issue requires no authentication or user interaction and is exploitable over the network.

Ubiquiti disclosed the vulnerability in Security Advisory Bulletin 069. Successful exploitation disrupts gateway availability, which can sever routing, firewall enforcement, and VPN termination for the networks the device serves.

Critical Impact
Unauthenticated network attackers can crash affected UniFi gateway devices, disrupting connectivity and network security enforcement for all downstream clients.

Affected Products

Ubiquiti UniFi gateway devices (specific models listed in Ubiquiti Security Advisory Bulletin 069)
Refer to the vendor advisory for exact model and firmware version coverage
No CPE identifiers have been published in NVD at this time

Discovery Timeline

2026-09-22 - CVE-2026-95862 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database
Vendor disclosure - Documented in Ubiquiti Security Advisory Bulletin 069

Technical Details for CVE-2026-95862

Vulnerability Analysis

The vulnerability is an out-of-bounds write in firmware running on affected UniFi gateway devices. The flaw allows a remote attacker to write data past the bounds of an allocated buffer. On embedded network devices, such writes typically corrupt adjacent memory structures and crash the responsible service or the underlying kernel.

The impact is limited to availability. The advisory does not indicate that the condition can be leveraged for code execution or information disclosure. Instead, exploitation degrades or halts device operation, forcing a reboot or manual recovery.

Because gateway devices sit at the network perimeter, an outage removes routing, NAT, firewall, and VPN services for every downstream client. Repeated exploitation can maintain the DoS state indefinitely without any credentials.

Root Cause

The underlying weakness is classified as [CWE-787] Out-of-Bounds Write. The affected code path writes beyond the end of an allocated memory buffer, most commonly the result of insufficient bounds checking on attacker-controlled input length or offset values processed by a network-facing service on the gateway.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker with access to a network segment reachable by the gateway sends crafted traffic to a vulnerable service. Processing that traffic triggers the out-of-bounds write and crashes the device. Ubiquiti's advisory is the authoritative source for the specific protocol and service affected.

No public proof-of-concept exploit is available at publication time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-95862

Indicators of Compromise

Unexpected reboots, watchdog resets, or service restarts on UniFi gateway devices
Gaps in device telemetry, syslog, or SNMP polling coincident with anomalous inbound traffic
Kernel oops, segmentation fault, or crash entries in gateway system logs
Recurring loss of WAN, VPN, or inter-VLAN routing without a corresponding configuration change

Detection Strategies

Correlate gateway uptime resets with packet captures at the perimeter to identify triggering traffic
Alert on repeated device unreachability events in UniFi Network Application or upstream monitoring
Baseline expected management-plane traffic and flag protocol anomalies targeting the gateway

Monitoring Recommendations

Forward gateway syslog to a centralized SIEM or data lake and retain crash events for analysis
Monitor ICMP reachability, BGP or OSPF adjacency flaps, and VPN tunnel state for the gateway
Track firmware versions across the UniFi estate to identify devices still exposed to CVE-2026-95862

How to Mitigate CVE-2026-95862

Immediate Actions Required

Review Ubiquiti Security Advisory Bulletin 069 to identify affected models in your environment
Apply the vendor-supplied firmware update to all impacted UniFi gateway devices
Restrict management-plane and untrusted network exposure to the gateway until patching is complete
Verify UniFi controller and device auto-update settings are enabled where operationally acceptable

Patch Information

Ubiquiti has published fixed firmware versions in Security Advisory Bulletin 069. Administrators should consult the advisory for the exact patched build for each affected gateway model and deploy through the UniFi Network Application or direct firmware upgrade.

Workarounds

Limit inbound access to gateway services from untrusted networks using upstream ACLs where feasible
Segment management interfaces onto a dedicated VLAN with strict source-address filtering
Enable device health monitoring and automated recovery to reduce outage duration if a crash occurs

bash

# Example: restrict gateway management exposure using upstream ACLs
# (Adjust interface names and management subnet to your environment)

# Permit only trusted management subnet to reach the gateway management plane
access-list 150 permit ip 10.10.10.0 0.0.0.255 host <gateway-wan-ip>
access-list 150 deny   ip any host <gateway-wan-ip> log
access-list 150 permit ip any any

interface GigabitEthernet0/0
 apply access-list 150 in