Executive brief
UniFi OS is a management platform used to monitor and control network infrastructure across Ubiquiti devices. A debug code path left active in the software allows a network-connected attacker with limited system privileges to escalate their access and gain full control of affected UniFi OS instances, potentially compromising the security of all managed network devices.
Technical details
The vulnerability is a privilege escalation flaw stemming from active debug code within UniFi OS that was not properly removed or disabled in production builds. The issue requires network access and low-level privileges to exploit, making it exploitable by a user with a basic account or via a compromised low-privileged service. Under certain conditions, an attacker can leverage this debug functionality to bypass authorization controls and escalate privileges to administrative level. The affected versions are specific builds of UniFi OS; patches are available from Ubiquiti through their security advisory.
Affected products
- Ubiquiti UniFi OS certain versions
Timeline
- 2026-08-26: disclosed