Threat Intelligence Report — CVE-2026-95861

Executive Summary

CVE-2026-95861 is an Uncontrolled Recursion (CWE-674) vulnerability affecting certain UniFi gateway devices. A remote, unauthenticated attacker with network access can trigger excessive recursive processing that exhausts device resources, resulting in a Denial of Service (DoS) condition. With a CVSS base score of 7.5 (High) and no patch evidence from any tracked source, affected deployments remain exposed until the vendor publishes a fix.

Technical Analysis

The vulnerability is classified under CWE-674: Uncontrolled Recursion. This weakness class occurs when a software component processes input through a recursive code path without an adequate depth limit, termination condition, or bound on recursion depth. When attacker-controlled input drives that path, the stack or associated memory structures grow without constraint until the process aborts, hangs, or the host exhausts available resources.

In the context described by the NVD, the affected component is "certain UniFi gateway devices" — network edge appliances that sit between the local network and the internet. The vulnerability is remotely reachable (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), and the attack complexity is assessed as Low (AC:L). This profile indicates that the trigger does not require a race condition, specialized configuration knowledge, or a MITM position — a single network-reachable input is sufficient to drive the recursive path.

The CVSS subscores are informative about scope: Confidentiality (C:N) and Integrity (I:N) impacts are None, while Availability impact is High (A:H). The Scope value is Unchanged (S:U), meaning the impacted security authority remains the vulnerable gateway itself rather than cascading to other components. Taken together, the vulnerability produces a pure denial-of-service outcome: the device stops reliably forwarding, routing, or processing traffic, but there is no evidence in the available data of data disclosure or modification.

Because recursion consumes resources on a bounded embedded platform — typical of gateway appliances with constrained memory and CPU headroom — a successful trigger can cause a full device outage, a management-plane lockup, or a crash and reboot loop. The specific protocol handler, packet type, or configuration surface that drives the recursive path is not disclosed in the available CNA/NVD text, and no public technical write-up or PoC has been identified. Consequently, the precise triggering input, the recursion depth that causes exhaustion, and the code-level function involved cannot be stated without fabrication. What can be asserted with confidence is the vulnerability class (unbounded recursion reachable over the network) and the resulting effect (availability loss).

Attack surface: any network-reachable service running on the UniFi gateway that performs recursive parsing or recursive expansion of input. Perimeter-facing gateways frequently expose management interfaces, WAN-facing services, and VPN termination — each of which represents a candidate pre-authentication attack surface for a remotely triggerable resource-exhaustion flaw. The absence of a CVSS Privileges Required value above None strongly implies that the recursive path is reachable before authentication completes.

Exploitation Scenarios

No public PoC or exploit code is available ("PoC/Exploit: None", "Nuclei Template: NO"). The attack chain below is inferred at the vulnerability-class level only and does not assert undocumented implementation details.

1. Reconnaissance / target identification. An attacker enumerates internet-exposed UniFi gateway devices using Shodan-family queries and network scans targeting common UniFi management and WAN-facing ports. Device fingerprinting identifies gateway models in scope for the advisory.

2. Pre-authentication reach. Because the CVSS vector specifies PR:N and AV:N, the attacker does not need credentials. The attacker selects a network-reachable entry point on the gateway — a service that performs recursive processing of incoming data.

3. Triggering the recursion (vulnerability-class level). The attacker sends crafted input designed to drive the vulnerable recursive routine into ever-deeper recursion. In uncontrolled-recursion flaws, the triggering input typically causes a parser to re-enter itself on nested or self-referential data without a depth cap. Each recursion level consumes stack frames (and in some implementations additional memory), so repeated or deeply nested input drives resource consumption past the platform's limit.

4. Resource exhaustion and DoS. As recursion depth grows unbounded, the affected process exhausts stack or heap resources. Depending on implementation, this yields a process crash, a watchdog-triggered reboot, or a hang in which the device stops processing traffic. Because UniFi gateways are single points of failure for the networks they serve, the availability impact is High (A:H) as reflected in the CVSS subscores.

5. Post-exploitation impact. No integrity or confidentiality impact is indicated (I:N, C:N). The attacker can repeat the trigger to hold the device offline — a sustained DoS — and may combine it with further attempts while the management plane is degraded. No evidence of lateral movement or data exfiltration is associated with this flaw in the supplied data.

Because no proof-of-concept exists, defenders should not assume weaponization is imminent, but should also not assume low real-world risk: the low attack complexity and lack of authentication make this a low-effort, repeatable denial-of-service primitive for any actor with network access to an exposed device.

Impact Assessment

The primary impact is availability loss. CVSS 3.1 base score is 7.5 (High), derived from AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Of note:

• AV:N — exploitable across a network boundary; WAN-exposed management or service interfaces expand reach.
• AC:L — no special conditions required beyond sending the triggering input.
• PR:N — no credentials needed.
• UI:N — no victim interaction.
• A:H — total loss of availability of the affected gateway while the condition persists.
• C:N / I:N — no confidentiality or integrity impact.
• S:U — impact is confined to the gateway's own security authority.

Business impact: UniFi gateways are perimeter devices. A successful DoS takes down routing, VPN connectivity, network segmentation, and centralized management for all downstream clients. For enterprises, this can translate to loss of remote access, branch isolation, and disruption of cloud and voice services. Blast radius is bounded by the number of gateways an organization exposes and the segments behind each device. Because the flaw requires only network access, an attacker positioned on a directly reachable link (WAN, adjacent network, or a compromised internal host with access to the management plane) can trigger it repeatedly. No EPSS score has been assigned by FIRST.org at the time of writing, and the CVE is not listed in CISA KEV, which reflects the current absence of confirmed in-the-wild exploitation rather than a lack of potential impact.

Detection Guidance

Sigma Rule

title: UniFi Gateway Uncontrolled Recursion DoS - Resource Exhaustion Indicators
id: 8b3f2c1a-4d5e-4f6a-9b7c-2026uni95861
status: experimental
description: Detects denial-of-service patterns consistent with CWE-674 uncontrolled recursion exploitation against UniFi gateway devices, including repeated crash/reboot events and abnormal process failures.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95861
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: syslog
detection:
  selection_crash:
    - 'kernel:.*stack overflow'
    - 'Out of memory'
    - 'oom-kill'
    - 'segfault'
    - 'watchdog.*reset'
    - 'unifi.*restart'
    - 'unifi.*crash'
  selection_repeat:
    - 'restart'
    - 'reboot'
    - 'core dumped'
  timeframe: 5m
  condition: selection_crash or (selection_repeat | count() > 3)
falsepositives:
  - Legitimate firmware updates requiring reboot
  - Power events causing unexpected restarts
level: high
tags:
  - attack.t1499
  - cwe.674

YARA Rule

rule CVE_2026_95861_UniFi_Uncontrolled_Recursion
{
    meta:
        description = "Detects indicators of uncontrolled recursion (CWE-674) denial-of-service activity targeting UniFi gateway devices"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95861"
        cve = "CVE-2026-95861"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "unifi" nocase ascii wide
        $s2 = "gateway" nocase ascii wide
        $s3 = "stack overflow" nocase ascii
        $s4 = "maximum recursion" nocase ascii
        $s5 = "recursion depth" nocase ascii
        $s6 = "core dumped" nocase ascii
        $s7 = "watchdog reset" nocase ascii

    condition:
        uint32(0) == 0x464c457f and
        (2 of ($s1, $s2)) and
        1 of ($s3, $s4, $s5, $s6, $s7)
}

Suricata IDS Rule

alert tcp any any -> any [80,443,8080,8443] (msg:"CVE-2026-95861 UniFi Gateway Uncontrolled Recursion DoS Attempt"; flow:to_server,established; content:"unifi"; http_header; nocase; threshold: type both, track by_src, count 50, seconds 10; classtype:attempted-dos; reference:cve,2026-95861; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95861; sid:202695861; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-95861, affected_product UniFi_Gateway;)

Note: the specific request signature (URL path, parameter name, or packet structure) is not disclosed in the available description. The rule targets high-volume, repeated requests to UniFi-facing services as a heuristic for the recursing trigger; it should be tuned to local traffic baselines to avoid false positives.

Elastic Detection

sequence by host.id with maxspan=5m
  [ process where event.type == "start" and process.name in ("unifi", "ubnt-syslog", "ubios-udapi-server") ]
  [ process where event.action == "end" and
      (process.exit_code != 0 or process.name in ("unifi", "ubios-udapi-server")) and
      process.exit_code in (134, 139, 6) ]

This EQL sequence fires when a UniFi gateway process restarts and then terminates abnormally (SIGABRT/SIGSEGV-class exit codes) within a five-minute window — a pattern consistent with resource-exhaustion-driven crashes.

Splunk SPL Query

index=network_or_syslog (sourcetype=unifi* OR product=unifi*)
| search ("stack overflow" OR "out of memory" OR "core dumped" OR "watchdog" OR "segfault" OR "recursion")
| stats count min(_time) as first_seen max(_time) as last_seen values(host) as affected_hosts by host
| where count > 3
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="unifi,cve-2026-95861">
  <rule id="2026958" level="10">
    <decoded_as>syslog</decoded_as>
    <match>unifi</match>
    <regex>stack overflow|Out of memory|core dumped|segfault|watchdog reset|maximum recursion|recursion depth</regex>
    <description>CVE-2026-95861: Possible UniFi gateway uncontrolled recursion denial-of-service (CWE-674)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>

  <rule id="2026959" level="12" frequency="4" timeframe="300">
    <if_matched_sid>2026958</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-95861: Repeated UniFi gateway crash/reboot events - sustained DoS suspected</description>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or fixed version is referenced in the available data.

1) Immediate mitigations (compensating controls):

• Restrict network access to UniFi gateway management and service interfaces. Place management planes behind VPN, jump hosts, or firewall allowlists; do not expose them to the WAN.
• Use network segmentation to limit which hosts can reach the gateway's exposed services, reducing the set of sources capable of reaching the recursive path.
• Enable rate limiting at upstream firewalls/load balancers for traffic destined to the gateway, so a burst of triggering input is throttled before exhausting gateway resources.
• Monitor for the crash/reboot patterns described in the detection section and set automated alerting on repeated restarts.
• Maintain configuration backups and, where possible, redundant or failover gateways to shorten outage windows.

2) Patch / upgrade steps:

• Monitor the vendor advisory channel for UniFi gateway firmware updates. No fixed version is currently identified.
• Subscribe to NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-95861) and Ubiquiti security advisory notifications for status changes.
• When firmware is released, stage the upgrade in a controlled environment before production rollout; validate that the recursion path is closed via regression testing (send the previously triggering input class and confirm normal handling).

3) Long-term hardening:

• Enforce out-of-band management on all edge gateways as a standing architectural rule.
• Apply firmware update SLAs for perimeter devices and track CVE exposure with an attack-surface inventory of internet-facing gateways.
• Where vendor firmware cannot be updated promptly, deploy hardware/inline DoS protection and connection-rate limits at the perimeter.
• Treat availability of edge gateways as a critical service: include DoS scenarios for these devices in incident response tabletop exercises.

References

• NVD — CVE-2026-95861 detail: https://nvd.nist.gov/vuln/detail/CVE-2026-95861
• CWE-674: Uncontrolled Recursion: https://cwe.mitre.org/data/definitions/674.html
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-95861 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

No public proof-of-concept, exploit code, Nuclei template, or known threat-actor campaign has been identified for this vulnerability at the time of writing. No in-the-wild exploitation evidence is available, and the CVE is not present in CISA KEV.