CVE-2026-54402 -- CVSS 9.9 Vulnerability Briefing

CVE-2026-54402 | CVSS 9.9 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-54402 is a command injection vulnerability rooted in improper input validation within UniFi OS, the operating system powering Ubiquiti's UniFi network devices and gateways.

Technical Detail

The flaw exists in UniFi OS's input handling routines, where user-supplied data is not adequately sanitized before being passed to system-level operations, allowing injected commands to execute on the underlying host. An attacker with low-privilege network access, meaning no administrative credentials are required, can craft malicious input to trigger the injection and achieve remote code execution (RCE) on the affected device. The CVSS score of 9.9 reflects the combination of low attack complexity, minimal privilege requirements, and the full system compromise potential that successful exploitation enables.

Exploitation Status

No known exploit code has been publicly released or observed in the wild as of July 09, 2026. This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as none at this time, though the low privilege bar and network-accessible attack surface make this a high-priority candidate for future exploitation development.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this CVE as of the date of this briefing.

What To Do

Apply any available UniFi OS patches from Ubiquiti immediately, prioritizing internet-facing and network-edge UniFi devices such as Dream Machines, Cloud Gateways, and UniFi Security Gateways. Given the low privilege requirement, treat this as a critical-priority patch regardless of whether devices are externally exposed. As an interim measure, restrict management interface access to trusted administrative VLANs or management networks and disable unnecessary network services on UniFi OS hosts. Monitor UniFi OS system logs and network traffic for anomalous command execution patterns or unexpected outbound connections originating from UniFi devices. Organizations should verify their UniFi OS version against Ubiquiti's security advisories and subscribe to Ubiquiti's security notification channel for patch availability updates.