Command Injection Vulnerability in UniFi OS Devices by Ubiquiti
CVE-2026-33000

9.1CRITICAL

Key Information:

Vendor: Ubiquiti Inc
Status: Unifi Os Server
Vendor: CVE Published:; 22 May 2026

🔔 Create Ubiquiti Inc Vulnerability Alert

What is CVE-2026-33000?

An Improper Input Validation vulnerability in UniFi OS devices from Ubiquiti allows a malicious actor with network access and elevated privileges to execute command injection. This exploit can lead to unauthorized actions within the system, potentially compromising the integrity of the affected devices. It's crucial for users to be aware of this risk and apply available security patches to safeguard their networks.

Affected Version(s)

UniFi OS Server 0 < 5.0.8

References

https://community.ui.com/releases/Security-Advisory-Bulle...

CVSS V3.1

Score:

9.1

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 22, 2026
Vulnerability Reserved
Mar 17, 2026

CVE-2026-33000 Data

JSON