CVE-2026-47370

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
Ubiquiti IncUniFi OS Server< 5.1.15
Ubiquiti IncExpress< 4.0.15
Ubiquiti IncUDM< 5.1.15
Ubiquiti IncUDM-Pro< 5.1.15
Ubiquiti IncUDM-SE< 5.1.15
Ubiquiti IncUDM-Pro-Max< 5.1.15
Ubiquiti IncUDM-Beast< 5.1.15
Ubiquiti IncEFG< 5.1.15
Ubiquiti IncUDW< 5.1.15
Ubiquiti IncUDR< 5.1.15
Ubiquiti IncUDR7< 5.1.15
Ubiquiti IncUDR-5G< 5.1.15
Ubiquiti IncExpress 7< 5.1.15
Ubiquiti IncUNVR< 5.1.15
Ubiquiti IncUNVR-Pro< 5.1.15
Ubiquiti IncUNVR-Instant< 5.1.15
Ubiquiti IncUNVR-G2< 5.1.15
Ubiquiti IncUNVR-G2-Pro< 5.1.15
Ubiquiti IncENVR< 5.1.15
Ubiquiti IncENVR-Core< 5.1.15
Ubiquiti IncUNAS-2< 5.1.16
Ubiquiti IncUNAS-4< 5.1.16
Ubiquiti IncUNAS-Pro< 5.1.16
Ubiquiti IncUNAS-Pro-4< 5.1.16
Ubiquiti IncUNAS-Pro-8< 5.1.16
Ubiquiti IncUCKP< 5.1.15
Ubiquiti IncUCK< 5.1.15
Ubiquiti IncUCK-Enterprise< 5.1.15
Ubiquiti IncUCG-Ultra< 5.1.15
Ubiquiti IncUCG-Max< 5.1.15
Ubiquiti IncUCG-Fiber< 5.1.15
Ubiquiti IncUCG-Industrial< 5.1.15

References

Timeline

Published
Jun 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-473729.1Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, CVE-2026-473737.5Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. DiscreCVE-2026-473756.0NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a PostgresCVE-2026-473765.1NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into CVE-2026-473775.1NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashRedirect plugin called window.location.reCVE-2026-473786.9NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns thatCVE-2026-473796.9NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back to strict-equality (CVE-2026-47389.4Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). TCVE-2026-473806.3NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown emCVE-2026-473816.9NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace's inCVE-2026-473825.3NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the uCVE-2026-473837.4NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments t
CVE-2026-47370: Critical severity, CVSS 9.9 | Vulnix