CVE-2026-47369

published 2026-06-12

CVE-2026-47369: A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi…

Priority P2 64 critical 9.9 CVSS 3.1

AV N AC L PR L UI N S C C H I H A H

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Affected

32 ranges · showing 25

Vendor	Product	Version range	Fixed in
ubiquiti_inc	efg	< 5.1.15	5.1.15
ubiquiti_inc	envr	< 5.1.15	5.1.15
ubiquiti_inc	envr-core	< 5.1.15	5.1.15
ubiquiti_inc	express	< 4.0.15	4.0.15
ubiquiti_inc	express_7	< 5.1.15	5.1.15
ubiquiti_inc	ucg-fiber	< 5.1.15	5.1.15
ubiquiti_inc	ucg-industrial	< 5.1.15	5.1.15
ubiquiti_inc	ucg-max	< 5.1.15	5.1.15
ubiquiti_inc	ucg-ultra	< 5.1.15	5.1.15
ubiquiti_inc	uck	< 5.1.15	5.1.15
ubiquiti_inc	uck-enterprise	< 5.1.15	5.1.15
ubiquiti_inc	uckp	< 5.1.15	5.1.15
ubiquiti_inc	udm	< 5.1.15	5.1.15
ubiquiti_inc	udm-beast	< 5.1.15	5.1.15
ubiquiti_inc	udm-pro	< 5.1.15	5.1.15
ubiquiti_inc	udm-pro-max	< 5.1.15	5.1.15
ubiquiti_inc	udm-se	< 5.1.15	5.1.15
ubiquiti_inc	udr	< 5.1.15	5.1.15
ubiquiti_inc	udr-5g	< 5.1.15	5.1.15
ubiquiti_inc	udr7	< 5.1.15	5.1.15
ubiquiti_inc	udw	< 5.1.15	5.1.15
ubiquiti_inc	unas-2	< 5.1.16	5.1.16
ubiquiti_inc	unas-4	< 5.1.16	5.1.16
ubiquiti_inc	unas-pro	< 5.1.16	5.1.16
ubiquiti_inc	unas-pro-4	< 5.1.16	5.1.16

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20