Threat Intelligence Report: CVE-2026-47369

Executive Summary

CVE-2026-47369 is a critical Improper Input Validation vulnerability (CWE-20) affecting certain devices running UniFi OS. A malicious actor with network access and low privileges can exploit this flaw to escalate privileges to root-level or administrative control within affected UniFi OS devices or instances. The vulnerability carries a CVSS score of 9.9 (Critical), reflecting the combination of network reachability, the low privilege barrier to exploitation, and the potential for full system compromise. Given that UniFi OS serves as the operating system for Ubiquiti's widely deployed UniFi network controller and gateway hardware, this vulnerability poses significant risk to enterprise networks, managed service providers, and any organization relying on UniFi infrastructure.

Technical Analysis

The vulnerability resides in an improper input validation flaw (CWE-20) within certain devices running UniFi OS. The NVD description indicates the flaw can be exploited by a malicious actor with access to the network and low privileges. The lack of proper input validation means the affected component does not sufficiently validate, sanitize, or properly handle user-supplied input before processing it in a security-sensitive context.

While the specific affected service or API endpoint is not disclosed in the NVD entry (as of this report), the vulnerability class (CWE-20) combined with the privilege escalation consequence suggests the flaw is exploitable through one of several attack vectors common to UniFi OS deployments:

1. Web-based Management Interface: UniFi OS devices expose administrative web interfaces (typically on TCP port 8443 or 443) for controller configuration. If the vulnerable code path is in the web management frontend, an authenticated low-privileged user (e.g., a "Viewer" or "Operator" role user) may be able to inject malicious input into request parameters, API calls, or form fields that are not properly validated before being processed.

2. Command Injection via Unvalidated Fields: Improper input validation in UniFi OS could allow a low-privileged user to inject shell metacharacters or operating system commands into fields that influence backend execution (e.g., hostname fields, diagnostic tools, or configuration parameters). If the application passes unsanitized input to system-level functions, this could result in arbitrary command execution with the privileges of the UniFi OS service — likely root given the architecture of the device operating system.

3. File Path Traversal / Arbitrary File Operations: If the unvalidated input is used to construct file paths (e.g., for backup/restore functionality, firmware imaging, or log file handling), a low-privileged attacker could write to or read arbitrary files on the system, including credentials, SSH keys, or configuration databases.

The vulnerability is described as exploitable with "access to the network and low privileges," meaning:

• The attacker does not need physical access to the device.
• The attacker does not need administrative credentials.
• The attacker likely needs only a valid low-privileged account (e.g., a user with viewer/operator permissions) or must be able to reach an unauthenticated vulnerable endpoint on the network.

Because the CVSS vector is not provided in the NVD entry, the score of 9.9 alone indicates this is a near-maximum severity issue. A score in this range typically corresponds to the following vector characteristics: Network attack vector (AV:N), Low attack complexity (AC:L), Low privileges required (PR:L), No user interaction (UI:N), and significant impacts on Confidentiality, Integrity, and Availability — with the possibility of a changed security scope (S:C).

The fact that the affected product lists as "hackerone / Unknown" in the CVE record metadata suggests the vulnerability was first reported through Ubiquiti's HackerOne bug bounty program, though the vendor impact assessment was still pending at the time of disclosure.

Exploitation Scenarios

The following attack chain describes the exploitation of CVE-2026-47369 from the perspective of a malicious actor with network access and low-privileged credentials. This is a hypothetical scenario based on the vulnerability class and available information, as no public exploit code or PoC exists at the time of writing.

Step 1: Reconnaissance and Target Identification

An attacker performs network reconnaissance to identify deployed UniFi OS devices. This may involve scanning for open management ports commonly used by Ubiquiti equipment:

• TCP port 8443 (UniFi Network Controller web UI)
• TCP port 8080 (UniFi inform/API port)
• TCP port 8843 (UniFi guest portal)
• TCP port 443 (HTTPS management interface)

Shodan-style queries such as product:"UniFi", http.title:"UniFi", or port:8443 ubiquiti would reveal Internet-exposed devices. For internal network targets, the attacker may use nmap -sV -p8443,8080,8843 <target_subnet> to identify UniFi OS instances. The attacker also fingerprints the exact firmware version via the login page or API responses to determine if the target falls within the affected range.

Step 2: Authentication and Privilege Establishment

The attacker obtains low-privileged credentials through one of several means:

• Default credentials if the administrator failed to change them (though Ubiquiti enforces credential changes on first login, this is still possible on some legacy hardware).
• Credential stuffing using previously leaked passwords — many UniFi installations are managed by MSPs with shared or weak password policies.
• Credential reuse from other breached services.
• Social engineering of an existing low-privileged user.
• If the login page allows self-registration (some UniFi configurations permit guest access creation), the attacker can create an account with "Guest" or "Operator" permissions.

Once authenticated, the attacker enumerates available functionality accessible to the low-privileged role. In UniFi OS, a low-privileged user might be able to:

• View network configuration
• Access diagnostic tools
• Modify certain settings lacking strict authorization checks
• Invoke API endpoints that are not adequately role-scoped

Step 3: Triggering the Input Validation Flaw

The attacker identifies a request parameter or input field that is not properly validated by the application. Likely candidates, based on the vulnerability class, include:

• Diagnostic utilities that accept host, IP, or domain names (used in ping, traceroute, or DNS lookup functions)
• Configuration fields for network names, SSIDs, hostnames, or other free-text entries
• API parameters used in PUT or POST requests to the management API

The attacker crafts a malicious payload. For example, if the vulnerable field is used in a system command context, the attacker might concatenate shell metacharacters to extend the intended command:

GET /api/s/default/cmd/diag/ping  HTTP/1.1
Host: 192.168.1.1:8443
Cookie: <session_cookie>

{"host": "8.8.8.8; id && cat /etc/passwd"}

Alternatively, if the flaw allows path traversal or arbitrary file writes:

{"log_path": "../../../../etc/cron.d/persist"}

The attacker submits the crafted request through the web interface or direct API call. Because the application fails to validate the input properly, the malformed payload is processed without sanitization.

Step 4: Privilege Escalation and Post-Exploitation

Successful exploitation grants the attacker elevated privileges within the UniFi OS environment — potentially administrative control of the controller and underlying operating system. The attacker may then:

• Create a new administrative account for persistent access
• Extract configuration secrets, including site keys, cloud credentials, and RADIUS shared secrets
• Exfiltrate network topology, client device lists, and any connected IoT/network hardware credentials
• Use the compromised device as a pivot point for lateral movement into the broader network
• Disable features, disrupt network monitoring, or alter security settings to remain undetected
• Deploy additional backdoors for long-term persistence

Because UniFi OS devices often serve as the central management point for an entire network infrastructure, compromise of the controller gives the attacker visibility into and control over all connected network devices, including access points, switches, and gateways.

Impact Assessment

CVSS Score: 9.9 (Critical) — This near-maximum score indicates the vulnerability poses a severe risk to confidentiality, integrity, and availability.

Business Impact:

• Confidentiality: Full compromise of the UniFi OS device exposes network credentials, encryption keys, site configurations, client device metadata, and potentially VPN credentials — all considered sensitive data.
• Integrity: An attacker with administrative control can modify network policies, disable security features (e.g., firewall rules, guest isolation), and plant malicious firmware or backdoors.
• Availability: The attacker could render the UniFi controller inoperable, disrupt connectivity across the entire managed network, or brick devices entirely.

Affected Systems:

• All UniFi OS devices (including UniFi Dream Machine series, Cloud Key series, and legacy UniFi Network Controller appliances) running affected firmware versions.
• Any network infrastructure managed by a compromised UniFi OS instance, including access points, switches, security gateways, and VLAN environments.
• Enterprises, universities, hospitality venues, MSPs, and home users relying on UniFi for network management.

Blast Radius:

• If the UniFi OS device is centrally deployed (common in multi-site enterprise networks), compromise of a single controller could expose or impair all connected sites.
• The vulnerability may allow a low-privileged attacker to pivot from an edge entry point to full infrastructure control.
• Given the network-access requirement and low privilege barrier, the attacker population includes any party who has obtained (or can register) a low-privileged account on the system.

Exploitability in the Wild:

• No public exploit code, PoC, or in-the-wild exploitation has been confirmed at the time of this report.
• EPSS score of 0.00303 (22.6th percentile) indicates low exploitation likelihood based on current threat modeling, but this may be a function of the very recent disclosure and lack of public intelligence.
• CISA KEV (Known Exploited Vulnerabilities) catalog does not currently list this CVE.

Detection Guidance

The following detection rules are designed to identify exploitation attempts and anomalous behavior consistent with CVE-2026-47369. Since the specific vulnerable endpoint is not confirmed, these rules focus on generic CWE-20 exploitation patterns targeting UniFi OS devices.

Sigma Rule

title: Potential CVE-2026-47369 - UniFi OS Command Injection / Privilege Escalation
id: 7e4ab30d-6b72-4b2e-8d4e-f0c4b9a8e11f
status: experimental
description: Detects common command injection or input validation abuse patterns in UniFi OS web logs, including shell metacharacters in HTTP request parameters.
author: Valtersit Threat Intelligence
date: 2026/01/15
tags:
    - attack.execution
    - attack.privilege_escalation
    - attack.t1059
    - attack.t1068
    - cve.2026.47369
logsource:
    category: webserver
    product: ubiquiti
    service: unifi
detection:
    selection_shell_metachars:
        http.url|contains:
            - ';'
            - '|'
            - '&&'
            - '||'
            - '$('
            - '`'
            - '%0a'
            - '%0d'
        http.method:
            - 'POST'
            - 'PUT'
            - 'GET'
    selection_suspicious_paths:
        http.url|contains:
            - '/api/'
            - '/cmd/'
            - '/diag/'
            - '/rest/'
    selection_privilege_context:
        user|contains:
            - 'viewer'
            - 'operator'
            - 'guest'
    condition: selection_shell_metachars and selection_suspicious_paths and selection_privilege_context
falsepositives:
    - Legitimate debugging or diagnostic use by administrators
    - Malformed automated scans
level: high

YARA Rule

rule CVE_2026_47369_UniFi_Exploit_Payloads
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects payload patterns and strings associated with CVE-2026-47369 exploitation attempts"
        date = "2026-01-15"
        reference = "CVE-2026-47369"
        severity = "critical"

    strings:
        $s1 = "cmd/diag" ascii wide
        $s2 = "api/s/default" ascii wide
        $s3 = "; id" ascii wide
        $s4 = "; whoami" ascii wide
        $s5 = "&& nc -e" ascii wide
        $s6 = "$(cat" ascii wide
        $s7 = "/etc/passwd" ascii wide
        $s8 = "unifi" ascii wide nocase
        $s9 = "dream.machine" ascii wide nocase
        $s10 = "cloud.key" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        filesize < 2MB and
        (2 of ($s*) )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-47369 - UniFi OS Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/"; http_uri; pcre:"/[\|\`;\&\$\x28\x29\x0a\x0d]/Ui"; content:"cmd|2f|diag|2f|"; http_uri; classtype:attempted-admin; sid:202647369; rev:1; reference:cve,2026-47369; priority:1;)

Elastic Detection

sequence by host.ip, user.name with maxspan=30s
  [ network where destination.port in (443, 8443) and network.protocol == "http"
    and http.request.method == "POST"
    and url.path like "*api*"
    and (url.query like "*;*" or url.query like "*|*" or url.query like "*`*" or url.query like "*(*" or url.query like "*$(*") ]
  [ process where event.type == "start" and process.name in ("sh", "bash", "ash", "dash", "python", "perl")
    and process.command_line like "*unifi*" or process.command_line like "*diag*" ]

Splunk SPL Query

index=proxy OR index=webserver OR index=unifi 
  (sourcetype="unifi:admin" OR sourcetype="apache:access" OR sourcetype="nginx:access")
  (method=POST OR method=PUT)
  uri_path="*api*"
  (query="*;*" OR query="*|*" OR query="*`*" OR query="*$(*" OR query="*&&*")
  | stats count by src_ip, user, uri, uri_path, status
  | where count > 3
  | table _time, src_ip, user, uri_path, uri, status, count

Wazuh OSSEC Rule

<group name="unifi_os,">
  <rule id="993915" level="14">
    <if_sid>31500</if_sid>
    <match>cmd/diag|api/s/default</match>
    <regex>[\|\`;&\$\(]</regex>
    <description>CVE-2026-47369: Potential UniFi OS command injection attempt via web management interface</description>
    <group>attack.privilege_escalation,attack.t1068,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No vendor patch, firmware update, or security advisory has been published for CVE-2026-47369 as of this report. Ubiquiti has not confirmed the affected firmware versions or released a fix. The following guidance is provided to help mitigate risk while awaiting an official patch.

1) Immediate Mitigations (until a patch is available):

• Restrict Network Access: Ensure UniFi OS management interfaces are not exposed to the public internet. If remote access is required, use a VPN or SSH tunnel rather than port forwarding to port 8443/8080/8843.
• Enforce Strong Low-Privilege Account Controls: Audit all user accounts with non-administrator roles. Revoke accounts that are not actively used. Require strong, unique passwords for all accounts, including low-privileged roles.
• Monitor Access Logs: Enable and actively review UniFi OS access logs for anomalous behavior, especially attempts to access diagnostic or API endpoints with unusual input parameters.
• Segmentation: Isolate UniFi OS devices on a dedicated management VLAN with strict firewall rules limiting which sources can reach management ports.
• Disable Unnecessary Features: If guest portal features (port 8843) are not needed, disable them. Similarly, disable any diagnostic tools accessible to low-privileged roles if configuration permits.
• Apply Principle of Least Privilege: Re-assign all users the minimum necessary privileges. Consider whether "Operator" or "Viewer" roles actually require access to diagnostic functions.

2) Patch / Upgrade Steps:

• Monitor the Ubiquiti community forums, HackerOne disclosure page, and vendor security announcements for a firmware update addressing CVE-2026-47369.
• When a firmware fix is released, apply the update to all affected UniFi OS devices immediately using the standard upgrade path: UniFi OS Settings > System > Updates.
• Prior to patching, take a configuration backup. Verify backup integrity to ensure rollback capability if the update introduces compatibility issues.

3) Long-Term Hardening:

• Establish a regular firmware update cadence for all UniFi OS hardware. Enable automatic updates where feasible.
• Conduct periodic security reviews of user accounts, roles, and permissions to ensure least-privilege principles are maintained.
• Deploy network segmentation for all management interfaces and critical infrastructure devices.
• Implement log aggregation and retention for UniFi OS devices so that forensic analysis is possible in the event of an incident.
• Consider deploying a Web Application Firewall (WAF) or API gateway in front of the UniFi management interface to filter suspicious request patterns.
• Subscribe to CVE notification feeds and vendor security advisories to stay informed of upcoming fixes.

Important Note: If your organization deploys UniFi OS devices in a multi-tenant environment or as a managed service (MSP), prioritize identifying the affected hardware, differentiating between administrative and low-privilege access, and temporarily limiting the functionalities available to lower-role users until the patch is released.

References

1. NVD Entry — CVE-2026-47369
   https://nvd.nist.gov/vuln/detail/CVE-2026-47369
   (NVD description and current CVE metadata as referenced in this report)

2. HackerOne Disclosure — Vendor report associated with CVE-2026-47369
   https://hackerone.com/ubiquiti
   (Vendor page where the original report was likely filed; direct link to the specific report is not public)

3. CISA Known Exploited Vulnerabilities Catalog
   https://www.cisa.gov/known-exploited-vulnerabilities-catalog
   (Checked: CVE-2026-47369 is NOT listed; catalog reviewed as of report date)

4. Ubiquiti Security Advisory Page
   https://www.ui.com/download/releases/security
   (Vendor security release page — monitor for an official advisory referencing CVE-2026-47369; none published at time of writing)

5. FIRST EPSS — CVE-2026-47369
   https://www.first.org/epss/
   (EPSS score: 0.00303, 22.6th percentile — low exploitation likelihood per current threat intelligence)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence:
As of the publication date of this report, there is no confirmed in-the-wild exploitation, no public exploit code, no Nuclei template, and no evidence of threat actor campaigns targeting CVE-2026-47369. The EPSS score (0.00303) and CISA KEV absence corroborate this low probability of active exploitation. Organizations should nonetheless remain vigilant, as the CVSS score of 9.9 indicates the vulnerability's severity warrants immediate attention upon any patch availability.