What Happened?
Ubiquiti has patched five security vulnerabilities in UniFi OS and the UID Enterprise Agent. The manufacturer classifies three of the vulnerabilities as critical and two others as high risk. Attackers could exploit the flaws to inject malicious code, bypass security measures, or gain unauthorized access to information, among other things. Ubiquiti has already released updated software versions that fix the issues.
The Details
In a security advisory, Ubiquiti lists the individual vulnerabilities along with their respective CVE identifiers:
- CVE-2026-47367 (CVSS 9.9, critical): Insufficient input validation in the UID Enterprise Agent allows attackers with network access and low privileges to execute commands on vulnerable hosts.
- CVE-2026-47370 (CVSS 9.9, critical): The same type of vulnerability affects UniFi OS on UniFi OS devices and instances, with a comparable impact.
- CVE-2026-47369 (CVSS 9.9, critical): Another vulnerability in UniFi OS devices and instances can be exploited for privilege escalation. Ubiquiti does not provide specific details about the attack vector in this case.
- CVE-2026-47368 (CVSS 8.6, high): A path traversal vulnerability allows attackers with network access to gain unauthorized access to data on various UniFi OS devices and instances.
- CVE-2026-48610 (CVSS 8.1, high): Insufficient privilege verification allows attackers with network access to make unauthorized changes to vulnerable UniFi OS devices in certain, unspecified configurations.
The flaws are fixed in UID Enterprise Agent 1.61.4. UniFi OS Server as well as numerous devices – including UDM, UDM-Beast, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial, and UCG-Fiber – receive the fix with version 5.1.15. For UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, and UNAS-Pro-8, version 5.1.16 is available, while Express receives update 4.0.15.
Assessment
This advisory is particularly relevant for operators of security technology, since UniFi OS devices are frequently used as central control and network infrastructure in video surveillance and access control systems. Recorders such as UNVR models or gateways like UDM and UCG devices often form the backbone of professional security installations. Successful exploitation of the critical vulnerabilities with CVSS scores of 9.9 could grant attackers far-reaching access to these systems – ranging from manipulation of recordings to complete compromise of the network infrastructure.
It is also worth noting that Ubiquiti had to patch additional security vulnerabilities in UniFi OS just about two weeks ago. At that time, three vulnerabilities even reached the maximum possible CVSS score of 10.0. This accumulation of security-relevant updates within a short period shows that the attack surface of complex network operating systems like UniFi OS remains a continuous focus for security researchers and potentially for attackers as well.
Practical Tips
- Immediately check which UniFi OS devices and instances are deployed in your infrastructure, and identify the currently installed firmware versions.
- Apply the updates provided by Ubiquiti promptly: UID Enterprise Agent 1.61.4, UniFi OS 5.1.15 or 5.1.16 for UNAS devices, and 4.0.15 for Express models.
- Restrict network access to UniFi OS devices as much as possible, since several of the described attacks require network access. Consistent network segmentation reduces the risk.
- Review permission concepts within the UniFi environment, particularly with regard to the privilege escalation vulnerability.
- Establish a process for regularly monitoring the manufacturer's security advisories, as updates have recently been released in quick succession.
Outlook
Given the repeated critical vulnerabilities in UniFi OS within a short timeframe, operators of security technology infrastructure should expect further security advisories from Ubiquiti. Details regarding the affected, unspecified configurations for CVE-2026-48610 are not yet known and are likely to be clarified in future advisories. In practical terms, this means that timely and consistent patch management for UniFi OS-based systems will become even more important going forward, in order to ensure the integrity of video surveillance, access control, and other security-critical applications.
