#ubiquiti
7 articles
UniFi OS: 12 Vulnerabilities Including Authentication Bypass (CVE-2026-77550)
Ubiquiti published a bulletin covering 12 vulnerabilities in UniFi OS and UniFi applications. The most severe lets an attacker with network access bypass authentication on UniFi OS devices...
CVE-2026-33000: Command injection in Ubiquiti UniFi OS
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection....
CVE-2026-34908: Improper access control in Ubiquiti UniFi OS
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system....
CVE-2026-34909: Path traversal in Ubiquiti UniFi OS
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an unde...
CVE-2026-34910: Command injection in Ubiquiti UniFi OS
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection....
CVE-2026-22557: Critical Path Traversal in Ubiquiti UniFi Network (CVSS 10.0)
Critical Path Traversal vulnerability in Ubiquiti UniFi Network Application (CVSS 10.0) allows unauthenticated attackers to access OS files and achieve account takeover. Affects Dream Machine and all UniFi Network Application installations <= 10.1.85.
CVE-2026-22558: Ubiquiti UniFi Network NoSQL Injection Vulnerability (CVSS 7.7)
NoSQL Injection vulnerability in Ubiquiti UniFi Network Application (CVSS 7.7) enables authenticated attackers to escalate privileges. When chained with CVE-2026-22557 (CVSS 10.0), it creates an attack chain leading to full system compromise.