CVE-2026-47368: UniFi OS Path Traversal Data Exposure (CVSS 8.6)

Technical summary

CVE-2026-47368 is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability affecting UniFi OS. The vulnerability permits network-adjacent threat actors to bypass directory restrictions and traverse the file system to access data they shouldn't be able to read. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates network accessibility, no special access required, low complexity, no user interaction, and high confidentiality impact with cross-boundary scope—meaning compromise of one instance could affect connected systems or trust relationships.

Business impact

Data exposure through path traversal poses significant risk to organizations deploying UniFi infrastructure. Attackers could extract API keys, certificates, administrative credentials, or network configuration data—enabling lateral movement, persistence, or further attacks against the broader infrastructure UniFi manages. For managed service providers, the cross-boundary scope means a single compromised UniFi instance could expose customer data or inter-tenant information, with potential regulatory (GDPR, HIPAA, PCI-DSS) and reputational consequences.

Affected systems

The vulnerability affects certain UniFi OS devices and cloud instances. The advisory does not enumerate specific product SKUs, firmware versions, or deployment models affected. Organizations must consult Ubiquiti's official advisory to confirm which controllers, gateways, or UniFi management platforms in their environment require remediation.

Exploitability

The attack surface is moderately broad but requires network-layer presence. An attacker must have network access to the UniFi OS device (LAN, compromised adjacent host, or cloud instance API endpoint), but requires no authentication, credentials, or social engineering. Path traversal is typically straightforward to exploit once discovered; however, blind exploitation without knowledge of file system paths may require reconnaissance or public disclosure of payloads. Current KEV status indicates no known public exploit as of publication, but path traversal flaws are generally considered highly exploitable once details emerge.

Remediation

Apply patches provided by Ubiquiti for affected UniFi OS versions. Organizations should prioritize patching controllers managing critical network segments first. If patches are unavailable, implement network segmentation to limit access to UniFi OS management interfaces, restrict API exposure, and monitor for suspicious file-read patterns in logs.

Patch guidance

Contact Ubiquiti support or consult their security advisories to identify the fixed firmware version for your specific UniFi OS product. Patches should be staged in a test environment before production deployment. Verify after patching that management functions and integrations continue to operate normally, as path traversal fixes sometimes require configuration adjustments. Document patch deployment dates for compliance audits.

Detection guidance

Monitor UniFi OS access logs for anomalous file-read patterns, especially paths containing traversal sequences (../, ..\, or URL-encoded variants %2e%2e). Alert on unexpected API calls to file-system endpoints, unusual data volume exfiltration from management interfaces, or errors indicating path-resolution failures. Implement network detection rules for suspicious HTTP requests to UniFi admin panels with path traversal payloads. Log centralization and SIEM tuning are essential for detecting lateral reconnaissance attempts.

Why prioritize this

HIGH severity (CVSS 8.6) driven by high confidentiality impact, network accessibility, and lack of authentication barriers. Path traversal directly exposes sensitive configuration and credential data. Organizations should prioritize patching based on exposure: cloud-hosted instances and multi-tenant deployments are highest risk, followed by internet-facing controllers and those managing sensitive network segments. Despite KEV status being false, the attack simplicity and data-exposure potential warrant swift remediation.

Risk score, explained

The CVSS 8.6 reflects high confidentiality impact (credentials, keys, configs exposed) and network accessibility without authentication. The low complexity and lack of user interaction mean exploitation can be rapid and automated. Cross-boundary scope (S:C) indicates that compromise of one UniFi OS instance may affect dependent systems or trust chains, amplifying organizational risk. However, the vector limits impact to confidentiality—no direct service disruption or system integrity compromise—which prevents a critical rating.

Frequently asked questions