# CVE-2026-47370: Ubiquiti UniFi OS command injection via improper input validation

Source: https://junglewise.ai/threats/cve-2026-47370-ubiquiti-unifi-os-command-injection-via-improper-input-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-47370 · Severity: critical · CVSS 9.9 · Published 2026-06-12

Ubiquiti UniFi OS, which powers various networking devices like routers and controllers, contains a critical security flaw. An attacker with basic network access and low-level user credentials can take complete control of the device. This could lead to the theft of sensitive data, disruption of network services, or a total compromise of the corporate network infrastructure managed by the device.

Technologies: [Ubiquiti UniFi OS](https://junglewise.ai/threats/technologies/unifi-os). Vendors: [Ubiquiti](https://junglewise.ai/threats/vendors/ubiquiti).

## Quick answers

**Is CVE-2026-47370 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47370 being exploited in the wild.

**How severe is CVE-2026-47370?** Critical severity, with a CVSS score of 9.9, published 12 June 2026.

**Which products and versions are affected?** Ubiquiti UniFi OS.

**Is there a fix for CVE-2026-47370?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47370 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-47370?** Check whether you run Ubiquiti UniFi OS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input validation vulnerability (CWE-20) exists in certain versions of Ubiquiti UniFi OS. The flaw allows an authenticated attacker with low privileges to inject and execute arbitrary commands on the underlying operating system via the network. The vulnerability is characterized by a high CVSS score of 9.9 due to its potential for full system compromise and scope change, meaning an attacker can move from the application layer to the host operating system. Users are advised to refer to Ubiquiti Security Advisory Bulletin 065 for specific version impact and patching information.

## Affected products

- Ubiquiti UniFi OS

## Timeline

- 2026-06-12: disclosed: Initial publication of the CVE record via HackerOne and NVD.
- 2026-06-12: advisory: Ubiquiti released Security Advisory Bulletin 065.

## References

- [https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a](https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a)

## Related threats

- [Ubiquiti UniFi OS CRLF injection authentication bypass](https://junglewise.ai/threats/cve-2026-77550-ubiquiti-unifi-os-crlf-injection-authentication-bypass)
- [Ubiquiti UniFi OS CRLF injection authentication bypass](https://junglewise.ai/threats/cve-2026-77549-ubiquiti-unifi-os-crlf-injection-authentication-bypass)
- [Ubiquiti UniFi OS active debug code privilege escalation](https://junglewise.ai/threats/cve-2026-77545-ubiquiti-unifi-os-active-debug-code-privilege-escalation)
- [Ubiquiti UniFi OS command injection vulnerability](https://junglewise.ai/threats/cve-2026-77540-ubiquiti-unifi-os-command-injection-vulnerability)
- [Ubiquiti UniFi OS command injection in input validation](https://junglewise.ai/threats/cve-2026-77539-ubiquiti-unifi-os-command-injection-in-input-validation)