Read the docs
TI-2026-34941 Aliases CVE-2026-47369GHSA-h6vq-x5fv-h7q3

Improper input validation in Ubiquiti UniFi OS Server

Priority MEDIUM 43CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00303 23rd percentileScored 2026-11-07
Fix Fixed UniFi OS Server (Ubiquiti Inc): 5.1.15Express (Ubiquiti Inc): 4.0.15+30 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UbiquitiUniFi OS Serverbefore 5.1.155.1.15Patch availableCNA
UbiquitiExpressbefore 4.0.154.0.15Patch availableCNA
UbiquitiUDMbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDM-Probefore 5.1.155.1.15Patch availableCNA
UbiquitiUDM-SEbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDM-Pro-Maxbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDM-Beastbefore 5.1.155.1.15Patch availableCNA
UbiquitiEFGbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDWbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDRbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDR7before 5.1.155.1.15Patch availableCNA
UbiquitiUDR-5Gbefore 5.1.155.1.15Patch availableCNA
UbiquitiExpress 7before 5.1.155.1.15Patch availableCNA
UbiquitiUNVRbefore 5.1.155.1.15Patch availableCNA
UbiquitiUNVR-Probefore 5.1.155.1.15Patch availableCNA
UbiquitiUNVR-Instantbefore 5.1.155.1.15Patch availableCNA
UbiquitiUNVR-G2before 5.1.155.1.15Patch availableCNA
UbiquitiUNVR-G2-Probefore 5.1.155.1.15Patch availableCNA
UbiquitiENVRbefore 5.1.155.1.15Patch availableCNA
UbiquitiENVR-Corebefore 5.1.155.1.15Patch availableCNA
UbiquitiUNAS-2before 5.1.165.1.16Patch availableCNA
UbiquitiUNAS-4before 5.1.165.1.16Patch availableCNA
UbiquitiUNAS-Probefore 5.1.165.1.16Patch availableCNA
UbiquitiUNAS-Pro-4before 5.1.165.1.16Patch availableCNA
UbiquitiUNAS-Pro-8before 5.1.165.1.16Patch availableCNA
UbiquitiUCKPbefore 5.1.155.1.15Patch availableCNA
UbiquitiUCKbefore 5.1.155.1.15Patch availableCNA
UbiquitiUCK-Enterprisebefore 5.1.155.1.15Patch availableCNA
UbiquitiUCG-Ultrabefore 5.1.155.1.15Patch availableCNA
UbiquitiUCG-Maxbefore 5.1.155.1.15Patch availableCNA
UbiquitiUCG-Fiberbefore 5.1.155.1.15Patch availableCNA
UbiquitiUCG-Industrialbefore 5.1.155.1.15Patch availableCNA
  • UniFi OS Server VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • Express VendorUbiquiti Affected before 4.0.15 Fixed in 4.0.15 Patch available CNA
  • UDM VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDM-Pro VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDM-SE VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDM-Pro-Max VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDM-Beast VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • EFG VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDW VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDR VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDR7 VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDR-5G VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • Express 7 VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UNVR VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UNVR-Pro VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UNVR-Instant VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UNVR-G2 VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UNVR-G2-Pro VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • ENVR VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • ENVR-Core VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UNAS-2 VendorUbiquiti Affected before 5.1.16 Fixed in 5.1.16 Patch available CNA
  • UNAS-4 VendorUbiquiti Affected before 5.1.16 Fixed in 5.1.16 Patch available CNA
  • UNAS-Pro VendorUbiquiti Affected before 5.1.16 Fixed in 5.1.16 Patch available CNA
  • UNAS-Pro-4 VendorUbiquiti Affected before 5.1.16 Fixed in 5.1.16 Patch available CNA
  • UNAS-Pro-8 VendorUbiquiti Affected before 5.1.16 Fixed in 5.1.16 Patch available CNA
  • UCKP VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCK VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCK-Enterprise VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCG-Ultra VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCG-Max VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCG-Fiber VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCG-Industrial VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA

Remediation

  • Fix · CNA UniFi OS Server (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA Express (Ubiquiti Inc) Fixed in 4.0.15
  • Fix · CNA UDM (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDM-Pro (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDM-SE (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDM-Pro-Max (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDM-Beast (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA EFG (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDW (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDR (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDR7 (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDR-5G (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA Express 7 (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UNVR (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UNVR-Pro (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UNVR-Instant (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UNVR-G2 (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UNVR-G2-Pro (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA ENVR (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA ENVR-Core (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UNAS-2 (Ubiquiti Inc) Fixed in 5.1.16
  • Fix · CNA UNAS-4 (Ubiquiti Inc) Fixed in 5.1.16
  • Fix · CNA UNAS-Pro (Ubiquiti Inc) Fixed in 5.1.16
  • Fix · CNA UNAS-Pro-4 (Ubiquiti Inc) Fixed in 5.1.16
  • Fix · CNA UNAS-Pro-8 (Ubiquiti Inc) Fixed in 5.1.16
  • Fix · CNA UCKP (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCK (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCK-Enterprise (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCG-Ultra (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCG-Max (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCG-Fiber (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCG-Industrial (Ubiquiti Inc) Fixed in 5.1.15

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Ubiquiti EFG, Express 7 and 13 more products 5.1.15

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-34942 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 44
    • TI-2026-35956 Improper access control in Ubiquiti UDMPriority LOW 37
    • TI-2026-34940 Path traversal in Ubiquiti UniFi OS ServerPriority LOW 37
    Show all 4 records →
  • Release ·

    Ubiquiti ENVR, ENVR-Core and 15 more products 4.0.15, 5.1.15, 5.1.16

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-34942 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 44
    • TI-2026-34940 Path traversal in Ubiquiti UniFi OS ServerPriority LOW 37
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47369
  2. 2026-10-03 Alias added: GHSA-h6vq-x5fv-h7q3

References

Other 1

  • TI-2026-27142 Improper input validation in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-27141 Path traversal in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-27140 Improper access control in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2010-05027 On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-19187 AirControl 1.4.2 - PreAuth Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2015-07644 Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload CVSS 3.0CRITICAL 9.8
See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences