CVE-2026-47369
A malicious actor with access to the network and low privileges could exploit an Improper Input...
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Record
CVE-2026-47369- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-36383
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Record
EUVD-2026-36383- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h6vq-x5fv-h7q3
A malicious actor with access to the network and low privileges could exploit an Improper Input...
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Record
GHSA-h6vq-x5fv-h7q3- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Record
CVE-2026-47369- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
- @clerk express
- free5gc udm
- free5gc udr
- ubiquiti inc efg
- ubiquiti inc envr
- ubiquiti inc envr-core
- ubiquiti inc express
- ubiquiti inc express 7
- ubiquiti inc ucg-fiber
- ubiquiti inc ucg-industrial
- ubiquiti inc ucg-max
- ubiquiti inc ucg-ultra
Show 23 moreShow less
- ubiquiti inc uck
- ubiquiti inc uck-enterprise
- ubiquiti inc uckp
- ubiquiti inc udm
- ubiquiti inc udm-beast
- ubiquiti inc udm-pro
- ubiquiti inc udm-pro-max
- ubiquiti inc udm-se
- ubiquiti inc udr
- ubiquiti inc udr-5g
- ubiquiti inc udr7
- ubiquiti inc udw
- ubiquiti inc unas-2
- ubiquiti inc unas-4
- ubiquiti inc unas-pro
- ubiquiti inc unas-pro-4
- ubiquiti inc unas-pro-8
- ubiquiti inc unifi os server
- ubiquiti inc unvr
- ubiquiti inc unvr-g2
- ubiquiti inc unvr-g2-pro
- ubiquiti inc unvr-instant
- ubiquiti inc unvr-pro
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47369 is a critical vulnerability (CVSS 9.9) in @clerk Express, published June 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. No source names a fixed version.