Improper input validation in Ubiquiti UniFi OS Server
Priority CRITICAL 100Exploited in the wildCWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
Why it matters now
Exploitation Active In CISA KEV since 2026-06-23CISA due date 2026-06-26
EPSS 0.90032 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed UniFi OS Server (Ubiquiti Inc): 5.0.8UDM (Ubiquiti Inc): 5.1.12+29 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ubiquiti | UniFi OS Server | before 5.0.8 | 5.0.8 | Patch available | CNA |
| Ubiquiti | UDM | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDM-Pro | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDM-SE | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDM-Pro-Max | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDM-Beast | before 5.1.11 | 5.1.11 | Patch available | CNA |
| Ubiquiti | EFG | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDW | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDR | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDR7 | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDR-5G | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | Express 7 | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR-Pro | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR-Instant | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR-G2 | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR-G2-Pro | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | ENVR | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | ENVR-Core | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNAS-2 | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UNAS-4 | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UNAS-Pro | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UNAS-Pro-4 | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UNAS-Pro-8 | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UCKP | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCK | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCK-Enterprise | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCG-Ultra | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCG-Max | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCG-Fiber | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCG-Industrial | before 5.1.12 | 5.1.12 | Patch available | CNA |
- UniFi OS Server VendorUbiquiti Affected before 5.0.8 Fixed in 5.0.8 Patch available CNA
- UDM VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDM-Pro VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDM-SE VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDM-Pro-Max VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDM-Beast VendorUbiquiti Affected before 5.1.11 Fixed in 5.1.11 Patch available CNA
- EFG VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDW VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDR VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDR7 VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDR-5G VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- Express 7 VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR-Pro VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR-Instant VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR-G2 VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR-G2-Pro VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- ENVR VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- ENVR-Core VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNAS-2 VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UNAS-4 VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UNAS-Pro VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UNAS-Pro-4 VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UNAS-Pro-8 VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UCKP VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCK VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCK-Enterprise VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCG-Ultra VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCG-Max VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCG-Fiber VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCG-Industrial VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
CPE configurations NVD · 61
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:* | before 5.0.8 | Vulnerable | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
- cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:* Versions before 5.0.8 Vulnerable ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
Show 51 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:enterprise_fortress_gateway:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_express_7:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_ultra:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloudkey_enterprise:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:* | before 5.1.11 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_pro_4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_pro_8:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
- cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:enterprise_fortress_gateway:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_express_7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_ultra:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloudkey_enterprise:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:* Versions before 5.1.11 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_pro_4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_pro_8:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
Remediation
- Fix · CNA UniFi OS Server (Ubiquiti Inc) Fixed in 5.0.8
- Fix · CNA UDM (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDM-Pro (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDM-SE (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDM-Pro-Max (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDM-Beast (Ubiquiti Inc) Fixed in 5.1.11
- Fix · CNA EFG (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDW (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDR (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDR7 (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDR-5G (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA Express 7 (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR-Pro (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR-Instant (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR-G2 (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR-G2-Pro (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA ENVR (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA ENVR-Core (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNAS-2 (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UNAS-4 (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UNAS-Pro (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UNAS-Pro-4 (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UNAS-Pro-8 (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UCKP (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCK (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCK-Enterprise (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCG-Ultra (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCG-Max (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCG-Fiber (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCG-Industrial (Ubiquiti Inc) Fixed in 5.1.12
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Ubiquiti UniFi OS Server 5.0.8
5 records Highest priority Priority CRITICAL 3 CRITICAL, 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-27141 Path traversal in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- TI-2026-27140 Improper access control in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- TI-2026-25448 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 44
- Release ·
Ubiquiti EFG, ENVR and 28 more products 5.1.10, 5.1.11, 5.1.12
4 records Highest priority Priority CRITICAL 3 CRITICAL, 1 LOW
Other records, highest priority first
- TI-2026-27141 Path traversal in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- TI-2026-27140 Improper access control in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- TI-2026-27143 Path traversal in Ubiquiti UniFi OS ServerPriority LOW 35
Timeline
- 2026-06-23 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2026-34910
- 2026-10-03 Alias added: GHSA-fvgm-jgwh-qwx7
- 2026-10-25 EPSS moved to the 99th percentile and above
References
More Ubiquiti Enterprise Fortress Gateway Firmware vulnerabilities
- TI-2026-27141 Path traversal in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-27140 Improper access control in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-39278 Improper input validation in Ubiquiti UniFi OS Server CVSS 3.1CRITICAL 9.9
- TI-2026-39279 Path traversal in Ubiquiti UniFi OS Server CVSS 3.1HIGH 8.6
- TI-2026-39280 SQL injection in Ubiquiti UniFi OS Server CVSS 3.1HIGH 8.8
- TI-2026-39277 Server-side request forgery in Ubiquiti UniFi OS Server CVSS 3.1HIGH 8.8
Sources
- CVE-2026-34910 · CVE Program
- CVE-2026-34910 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-fvgm-jgwh-qwx7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences