Read the docs
TI-2026-34942 Aliases CVE-2026-47370GHSA-m7hq-4j28-748g

Improper input validation in Ubiquiti UniFi OS Server

Priority MEDIUM 44CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00834 57th percentileScored 2026-11-07
Fix Fixed UniFi OS Server (Ubiquiti Inc): 5.1.15Express (Ubiquiti Inc): 4.0.15+30 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UbiquitiUniFi OS Serverbefore 5.1.155.1.15Patch availableCNA
UbiquitiExpressbefore 4.0.154.0.15Patch availableCNA
UbiquitiUDMbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDM-Probefore 5.1.155.1.15Patch availableCNA
UbiquitiUDM-SEbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDM-Pro-Maxbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDM-Beastbefore 5.1.155.1.15Patch availableCNA
UbiquitiEFGbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDWbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDRbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDR7before 5.1.155.1.15Patch availableCNA
UbiquitiUDR-5Gbefore 5.1.155.1.15Patch availableCNA
UbiquitiExpress 7before 5.1.155.1.15Patch availableCNA
UbiquitiUNVRbefore 5.1.155.1.15Patch availableCNA
UbiquitiUNVR-Probefore 5.1.155.1.15Patch availableCNA
UbiquitiUNVR-Instantbefore 5.1.155.1.15Patch availableCNA
UbiquitiUNVR-G2before 5.1.155.1.15Patch availableCNA
UbiquitiUNVR-G2-Probefore 5.1.155.1.15Patch availableCNA
UbiquitiENVRbefore 5.1.155.1.15Patch availableCNA
UbiquitiENVR-Corebefore 5.1.155.1.15Patch availableCNA
UbiquitiUNAS-2before 5.1.165.1.16Patch availableCNA
UbiquitiUNAS-4before 5.1.165.1.16Patch availableCNA
UbiquitiUNAS-Probefore 5.1.165.1.16Patch availableCNA
UbiquitiUNAS-Pro-4before 5.1.165.1.16Patch availableCNA
UbiquitiUNAS-Pro-8before 5.1.165.1.16Patch availableCNA
UbiquitiUCKPbefore 5.1.155.1.15Patch availableCNA
UbiquitiUCKbefore 5.1.155.1.15Patch availableCNA
UbiquitiUCK-Enterprisebefore 5.1.155.1.15Patch availableCNA
UbiquitiUCG-Ultrabefore 5.1.155.1.15Patch availableCNA
UbiquitiUCG-Maxbefore 5.1.155.1.15Patch availableCNA
UbiquitiUCG-Fiberbefore 5.1.155.1.15Patch availableCNA
UbiquitiUCG-Industrialbefore 5.1.155.1.15Patch availableCNA
  • UniFi OS Server VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • Express VendorUbiquiti Affected before 4.0.15 Fixed in 4.0.15 Patch available CNA
  • UDM VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDM-Pro VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDM-SE VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDM-Pro-Max VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDM-Beast VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • EFG VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDW VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDR VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDR7 VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDR-5G VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • Express 7 VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UNVR VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UNVR-Pro VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UNVR-Instant VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UNVR-G2 VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UNVR-G2-Pro VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • ENVR VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • ENVR-Core VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UNAS-2 VendorUbiquiti Affected before 5.1.16 Fixed in 5.1.16 Patch available CNA
  • UNAS-4 VendorUbiquiti Affected before 5.1.16 Fixed in 5.1.16 Patch available CNA
  • UNAS-Pro VendorUbiquiti Affected before 5.1.16 Fixed in 5.1.16 Patch available CNA
  • UNAS-Pro-4 VendorUbiquiti Affected before 5.1.16 Fixed in 5.1.16 Patch available CNA
  • UNAS-Pro-8 VendorUbiquiti Affected before 5.1.16 Fixed in 5.1.16 Patch available CNA
  • UCKP VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCK VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCK-Enterprise VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCG-Ultra VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCG-Max VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCG-Fiber VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCG-Industrial VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA

Remediation

  • Fix · CNA UniFi OS Server (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA Express (Ubiquiti Inc) Fixed in 4.0.15
  • Fix · CNA UDM (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDM-Pro (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDM-SE (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDM-Pro-Max (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDM-Beast (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA EFG (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDW (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDR (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDR7 (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDR-5G (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA Express 7 (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UNVR (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UNVR-Pro (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UNVR-Instant (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UNVR-G2 (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UNVR-G2-Pro (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA ENVR (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA ENVR-Core (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UNAS-2 (Ubiquiti Inc) Fixed in 5.1.16
  • Fix · CNA UNAS-4 (Ubiquiti Inc) Fixed in 5.1.16
  • Fix · CNA UNAS-Pro (Ubiquiti Inc) Fixed in 5.1.16
  • Fix · CNA UNAS-Pro-4 (Ubiquiti Inc) Fixed in 5.1.16
  • Fix · CNA UNAS-Pro-8 (Ubiquiti Inc) Fixed in 5.1.16
  • Fix · CNA UCKP (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCK (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCK-Enterprise (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCG-Ultra (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCG-Max (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCG-Fiber (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCG-Industrial (Ubiquiti Inc) Fixed in 5.1.15

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Ubiquiti EFG, Express 7 and 13 more products 5.1.15

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-34941 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 43
    • TI-2026-35956 Improper access control in Ubiquiti UDMPriority LOW 37
    • TI-2026-34940 Path traversal in Ubiquiti UniFi OS ServerPriority LOW 37
    Show all 4 records →
  • Release ·

    Ubiquiti ENVR, ENVR-Core and 15 more products 4.0.15, 5.1.15, 5.1.16

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-34941 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 43
    • TI-2026-34940 Path traversal in Ubiquiti UniFi OS ServerPriority LOW 37
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47370
  2. 2026-10-03 Alias added: GHSA-m7hq-4j28-748g

References

Other 1

  • TI-2026-27142 Improper input validation in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-27141 Path traversal in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-27140 Improper access control in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2010-05027 On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-19187 AirControl 1.4.2 - PreAuth Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2015-07644 Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload CVSS 3.0CRITICAL 9.8
See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences