CVE-2026-47368

published 2026-06-12

CVE-2026-47368: A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such…

Priority P3 52 high 8.6 CVSS 3.1

AV N AC L PR N UI N S C C H I N A N

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such UniFi OS devices or instances.

Affected

32 ranges · showing 25

Vendor	Product	Version range	Fixed in
ubiquiti_inc	efg	< 5.1.15	5.1.15
ubiquiti_inc	envr	< 5.1.15	5.1.15
ubiquiti_inc	envr-core	< 5.1.15	5.1.15
ubiquiti_inc	express	< 4.0.15	4.0.15
ubiquiti_inc	express_7	< 5.1.15	5.1.15
ubiquiti_inc	ucg-fiber	< 5.1.15	5.1.15
ubiquiti_inc	ucg-industrial	< 5.1.15	5.1.15
ubiquiti_inc	ucg-max	< 5.1.15	5.1.15
ubiquiti_inc	ucg-ultra	< 5.1.15	5.1.15
ubiquiti_inc	uck	< 5.1.15	5.1.15
ubiquiti_inc	uck-enterprise	< 5.1.15	5.1.15
ubiquiti_inc	uckp	< 5.1.15	5.1.15
ubiquiti_inc	udm	< 5.1.15	5.1.15
ubiquiti_inc	udm-beast	< 5.1.15	5.1.15
ubiquiti_inc	udm-pro	< 5.1.15	5.1.15
ubiquiti_inc	udm-pro-max	< 5.1.15	5.1.15
ubiquiti_inc	udm-se	< 5.1.15	5.1.15
ubiquiti_inc	udr	< 5.1.15	5.1.15
ubiquiti_inc	udr-5g	< 5.1.15	5.1.15
ubiquiti_inc	udr7	< 5.1.15	5.1.15
ubiquiti_inc	udw	< 5.1.15	5.1.15
ubiquiti_inc	unas-2	< 5.1.16	5.1.16
ubiquiti_inc	unas-4	< 5.1.16	5.1.16
ubiquiti_inc	unas-pro	< 5.1.16	5.1.16
ubiquiti_inc	unas-pro-4	< 5.1.16	5.1.16

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22