Quick answers
- Is CVE-2026-47370 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-47370 being exploited in the wild.
- How severe is CVE-2026-47370?
- Critical severity, with a CVSS score of 9.9, published 12 June 2026.
- Which products and versions are affected?
- Ubiquiti UniFi OS.
- Is there a fix for CVE-2026-47370?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-47370 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-47370?
- Check whether you run Ubiquiti UniFi OS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An improper input validation vulnerability (CWE-20) exists in certain versions of Ubiquiti UniFi OS. The flaw allows an authenticated attacker with low privileges to inject and execute arbitrary commands on the underlying operating system via the network. The vulnerability is characterized by a high CVSS score of 9.9 due to its potential for full system compromise and scope change, meaning an attacker can move from the application layer to the host operating system. Users are advised to refer to Ubiquiti Security Advisory Bulletin 065 for specific version impact and patching information.
Affected products
- Ubiquiti UniFi OS
Timeline
- 2026-06-12: disclosed: Initial publication of the CVE record via HackerOne and NVD.
- 2026-06-12: advisory: Ubiquiti released Security Advisory Bulletin 065.