CVE-2026-95862

Executive Summary

CVE-2026-95862 is a high-severity out-of-bounds write (CWE-787) vulnerability affecting "certain UniFi gateway devices" per the NVD description. A network-adjacent or remote attacker with access to the device network can trigger the flaw to crash or render the device unresponsive, resulting in a denial-of-service condition. With a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no authentication or user interaction is required, and there is currently no vendor patch, no public proof-of-concept, and no EPSS score available.

Technical Analysis

CVE-2026-95862 is classified as an out-of-bounds write (CWE-787), meaning the vulnerable code writes data past the end of an allocated buffer. Memory-corruption bugs of this class arise when length, index, or size fields derived from attacker-controlled input are not validated before a memory write operation. Because the write escapes the intended buffer boundaries, adjacent memory — which may include control structures, heap metadata, or other in-process data — can be overwritten, leading to memory corruption, crashes, or potentially code execution depending on heap layout and the nature of the overwritten data.

The NVD description attributes the flaw to "certain UniFi gateway devices." At the time of writing, no CNA title, no affected version enumeration, no OSV package mapping, and no vendor advisory are available. Consequently, the precise protocol, input vector, parsing routine, or code path that triggers the out-of-bounds write cannot be confirmed from the provided intelligence. This report therefore describes the vulnerability at the class level and does not assert specific function names, endpoints, ports, or parameters beyond those explicitly present in the CVE description.

Attack surface considerations: UniFi gateway devices are network perimeter appliances that process inbound traffic, VPN sessions, firewall/IDS rules, WAN-facing services, and management traffic. Any of these traffic-handling or management planes that parse untrusted network input could, in principle, host the vulnerable write primitive. However, without the CNA or vendor advisory, attributing the flaw to a specific service would be speculative and is explicitly avoided here.

CVSS environmental reasoning: The AV:N (network) metric indicates the vulnerability is reachable over a network path, not requiring local access. AC:L (low complexity) indicates no special preconditions or race conditions are required. PR:N (no privileges) means the attacker needs no valid credentials. UI:N (no user interaction) means no victim must open a file or click a link. The C/I impacts are None, while A (availability) is High — consistent with the description's statement that the outcome is a Denial of Service.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-95862. The attack chain below is inferred strictly from the vulnerability class (out-of-bounds write) and the NVD description's stated impact (DoS on UniFi gateway devices). No specific implementation details are asserted.

1. Reconnaissance / target identification: The attacker identifies UniFi gateway devices exposed on a network. This could be achieved through internet scanning (e.g., Shodan queries for UniFi product banners, management interfaces, or device certificates) or by an adversary already positioned on the internal network. The description states the actor must have "access to the network," which may mean either the WAN side (if the vulnerable parsing path is Internet-reachable) or the LAN side.

2. Triggering the flaw: The attacker sends crafted network input to the vulnerable parsing path on the gateway. Because the flaw is an out-of-bounds write, the supplied data likely includes a length, count, or size value that exceeds what the receiving buffer was allocated for. The write proceeds beyond the buffer boundary. The exact input format (protocol, field, encoding) is unknown from available data and is not fabricated here.

3. Execution method: At the vulnerability-class level, the attacker does not need credentials or user interaction — the payload is delivered directly to the vulnerable code path as network traffic. If the write corrupts critical memory, the device process handling that traffic will crash or behave unpredictably.

4. Post-exploitation impact: Per the NVD description, the objective is Denial of Service — the gateway becomes unresponsive or its service crashes. Depending on device architecture and firmware robustness, the impact may range from a restart of the affected service to a full device reboot, interrupting network connectivity, firewall enforcement, VPN sessions, and management access for all downstream users. Repeated triggering can sustain the outage. The CVE description does not indicate data exfiltration or code execution as an outcome, and no such claim should be inferred from the CVSS vector, which marks C and I as None.

Impact Assessment

Business impact centers on availability. A compromised UniFi gateway is a network chokepoint: if it crashes, downstream connectivity, routing, firewall policy enforcement, and remote access (VPN) can be disrupted for all users behind it. Because the CVSS vector shows PR:N/UI:N/AC:L, the barrier to exploitation is low and no privileged foothold is required, increasing the likelihood that an attacker with network reach could reliably induce the DoS.

Blast radius: Affected systems are UniFi gateway devices; the exact models and firmware versions are not enumerated in the provided data, so the full population of vulnerable units cannot be quantified here. Any environment relying on a vulnerable unit for perimeter routing, segmentation, or remote access inherits the availability risk. The CVSS subscores (C:N/I:N/A:H) indicate no confidentiality or integrity impact is expected from this specific flaw, so data theft or data tampering are not implied.

Threat context: EPSS has not yet been scored by FIRST.org, so no probabilistic exploitation estimate is available. CVE-2026-95862 is not listed in CISA KEV. No public exploit, PoC, or Nuclei template exists, which currently lowers the immediate likelihood of opportunistic mass exploitation — but the absence of a public PoC does not preclude private or targeted weaponization, and the lack of a patch makes the exposure persistent.

Detection Guidance

Note: Because no specific protocol, endpoint, or payload structure is available, the following rules detect the vulnerability class — anomalous traffic toward UniFi gateway management/service surfaces and device availability events — rather than a signature of the exact trigger. Rules should be tuned to the organization's known-good UniFi traffic baselines to avoid false positives.

Sigma Rule

title: Suspected UniFi Gateway Out-of-Bounds Write DoS Attempt (CVE-2026-95862)
id: 8f2c1a44-7b91-4e0a-9d3c-unifi95862
status: experimental
description: Detects potential exploitation attempts of an out-of-bounds write vulnerability in certain UniFi gateway devices leading to denial of service.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95862
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: suricata
detection:
  selection_dest:
    dest_port:
      - 443
      - 8443
      - 8080
  selection_event:
    event_type:
      - alert
    alert_signature|contains:
      - 'UniFi'
      - 'out-of-bounds'
  condition: selection_dest and selection_event
falsepositives:
  - Legitimate management traffic to UniFi controllers
level: high
tags:
  - attack.t1499
  - cve.2026-95862

YARA Rule

rule CVE_2026_95862_UniFi_OOB_Write_DoS
{
    meta:
        description = "Detects references to the UniFi gateway out-of-bounds write DoS vulnerability CVE-2026-95862 in logs, advisories, or captured artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95862"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cve = "CVE-2026-95862" ascii wide nocase
        $uni = "UniFi gateway" ascii wide nocase
        $oob = "out-of-bounds write" ascii wide nocase
        $dos = "denial of service" ascii wide nocase

    condition:
        $cve or ($uni and ($oob or $dos))
}

Suricata IDS Rule

alert tcp any any -> any 443 (msg:"CVE-2026-95862 Possible UniFi Gateway Out-of-Bounds Write DoS Attempt"; flow:to_server,established; content:"UniFi"; nocase; threshold: type both, track by_src, count 20, seconds 10; classtype:attempted-dos; reference:cve,2026-95862; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95862; sid:90095862; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where destination.port in (443, 8443, 8080) and network.transport == "tcp" ]
  [ network where event.action == "denied" or network.bytes > 10000 and destination.port in (443, 8443, 8080) ]

Splunk SPL Query

index=network (dest_port=443 OR dest_port=8443 OR dest_port=8080)
| search ("unifi" OR "UniFi" OR "gateway")
| stats count by src_ip, dest_ip, dest_port
| where count > 50
| sort - count

Wazuh OSSEC Rule

<group name="unifi,cve-2026-95862,">
  <rule id="100862" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">UniFi</field>
    <match>out-of-bounds|denial of service|gateway crash|unresponsive</match>
    <description>CVE-2026-95862: Possible UniFi gateway out-of-bounds write DoS activity detected.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>attack,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is available.

1. Immediate mitigations:

   • Restrict network access to UniFi gateway management and service interfaces to trusted administrative networks only; do not expose management planes to the Internet unless strictly required and protected.
   • Apply segmentation and firewall rules so that only expected hosts and protocols can reach gateway service ports.
   • Monitor gateway CPU/memory and service availability for unexpected crashes or reboots; correlate with traffic anomalies to detect exploitation attempts.
   • Enable and ship gateway logs to a SIEM so restart/crash events are observable.
   • Where feasible, place redundant gateways or failover paths to reduce availability impact if a single unit is taken down.

2. Patch/upgrade steps:

   • No patch currently exists. Monitor Ubiquiti's official advisory/security channels and the NVD entry for CVE-2026-95862 for a fixed firmware version.
   • When a fix is released, inventory all UniFi gateway devices, stage the firmware update in a controlled window, verify the update applied, and confirm management access is restored.

3. Long-term hardening:

   • Maintain an accurate asset inventory of UniFi gateway devices and firmware versions to enable rapid response when a patch lands.
   • Adopt a network-hardening baseline that minimizes externally reachable management interfaces on perimeter devices.
   • Subscribe to vendor advisories and CVE feeds; given the unpatched status, treat this as an open risk item until remediated.
   • Restrict and log administrative access; enforce least privilege on who can reach device management.

References

• NVD — CVE-2026-95862: https://nvd.nist.gov/vuln/detail/CVE-2026-95862
• MITRE CWE-787 (Out-of-bounds Write): https://cwe.mitre.org/data/definitions/787.html
• MITRE ATT&CK T1499 (Endpoint Denial of Service): https://attack.mitre.org/techniques/T1499/
• Ubiquiti Security Advisory portal (monitor for CVE-2026-95862 advisory): https://www.ui.com/security
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-95862 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / ITW note: No known threat actor campaigns or exploit-in-the-wild activity are associated with CVE-2026-95862 in the available data. EPSS is not yet scored, and the vulnerability is not in CISA KEV. No PoC, exploit code, or Nuclei template is public.