Executive brief
UniFi OS is the operating system powering Ubiquiti's network infrastructure devices. A network-accessible attacker with low privilege credentials can exploit an access control flaw to escalate privileges and gain full control of UniFi OS devices, potentially compromising network security and access to sensitive network management functions.
Technical details
The vulnerability is an improper access control flaw in UniFi OS that allows a low-privileged, network-authenticated attacker to escalate privileges on the affected device or instances. The attack requires network access and valid low-level credentials but does not require additional user interaction. Successful exploitation grants an attacker elevated privileges, enabling complete compromise of the UniFi OS device. Patches are available from Ubiquiti via their security advisory.
Affected products
- Ubiquiti UniFi OS
Timeline
- 2026-08-26: disclosed