External risk intelligence

UniFi OS Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-54402

UniFi OS runs on network appliances such as gateways and consoles, which are commonly deployed as internet-facing edge devices to manage network infrastructure and provide remote access capabilities.

Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in UniFi OS could allow a low-privilege attacker on the network to execute commands on devices running the software. This issue involves improper input validation, which, if exploited, could lead to significant compromise of the affected host devices. The main concern is confirming the relevance and exposure of this vulnerability to our specific environment.

A network flaw lets attackers run commands on devices.
It affects network devices, critical to infrastructure.
Assess our UniFi OS exposure and impact.

Attack Path

How an attacker could exploit the issue

An attacker with network access and basic privileges could exploit an improper input validation flaw in UniFi OS. This vulnerability allows for command injection on the device. The attacker would need to be on the same network and have some level of access to the UniFi OS to initiate the attack.

Network access and low privileges required.
Vulnerable input validation allows command injection.
Risk of host device compromise.

Live Threat

Current exploitation, exposure, and threat context

A malicious actor on the network with low privileges could exploit this vulnerability to execute commands on the host device, potentially impacting the confidentiality, integrity, and availability of the system. This could occur when the vulnerable input validation is triggered.

System data and services at risk.
Command injection via network access.
Complete system compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

An Improper Input Validation vulnerability in UniFi OS allows a low-privilege, network-accessible attacker to achieve command injection. This impacts network infrastructure management devices, making it critical for infrastructure and security teams to triage exposure. The first practical step is to identify all UniFi OS instances, confirm their network exposure and business criticality, and then determine the accountable owner for remediation planning.

Infrastructure and security teams own remediation.
Verify UniFi OS network exposure and criticality.
Plan and execute remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is UniFi OS?

UniFi OS is a centralized management platform used to operate network infrastructure hardware. It serves as the underlying operating environment for various Ubiquiti networking products, such as gateways and consoles, enabling administrators to configure, monitor, and maintain local network traffic and remote access services from a single interface.

How does CVE-2026-54402 allow command injection?

This vulnerability stems from a weakness known as Improper Input Validation (CWE-20). It means the system fails to sufficiently filter or sanitize data provided by a user before processing it. Because of this flaw, a malicious actor can insert unauthorized commands into the system's input fields, which the device then executes with the same permissions as the underlying application.

Do I need to be a system administrator to trigger this bug?

No. An attacker does not require high-level administrative rights; they only need a low-privilege account on the network. However, the flaw is not triggered by public traffic that does not reach authenticated management interfaces. The attacker must have established network access and the ability to interact with the device's internal inputs to initiate the exploit.

Why is this a high-risk issue according to Halo Surface Signal?

Halo Surface Signal identifies this as a significant concern because UniFi OS is frequently deployed on network appliances serving as internet-facing edge devices. Since these gateways often sit at the perimeter to facilitate remote management, they are more easily reachable by external actors compared to devices restricted entirely to internal segments.

When should I begin my response to this vulnerability?

You should start immediately by cataloging all instances of UniFi OS within your environment. Once you have identified these devices, verify their network placement—specifically whether they are exposed to the internet—and determine their role in your infrastructure. After assessing this level of exposure and business criticality, coordinate with the appropriate team owners to prioritize remediation.

References

community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.