UniFi OS Server
Ubiquiti's management software for Dream Machine and Cloud Key appliances; three CVSS-10 flaws patched June 2026.
UniFi OS Server, Ubiquiti's management software for its network appliances, carried three maximum-severity flaws that together let an outsider reach root with no login, until a 23 June 2026 fix landed in version 5.0.8.
Last refreshed: 3 August 2026 · Appears in 1 active topic
What does a chained CVSS-10 exploit mean for businesses running older UniFi versions?
Timeline for UniFi OS Server
Mentioned in: KEV patch clocks fell to three days
Cybersecurity: Threats and DefencesExposed unauthenticated root via three-CVE chain until version 5.0.8
Cybersecurity: Threats and Defences: Triple CVSS-10 Ubiquiti chain hits rootBackground
UniFi OS Server is Ubiquiti's management software for its Dream Machine and Cloud Key network appliances, the control layer administrators use to configure and monitor UniFi-based networks.
Because it runs on appliances deployed at scale across small business and managed-service-provider networks, flaws in UniFi OS Server carry a wide blast radius: a single vulnerability class can expose a very large population of devices simultaneously.
As the software layer shared across an entire appliance family, UniFi OS Server updates typically apply fleet-wide once an administrator pushes them, which can make a single patch release consequential across many devices at once. It is maintained by Ubiquiti and is not sold or licensed separately from the appliances it manages.
Three flaws in UniFi OS gave root
Three separate weaknesses sat in UniFi OS Server before 23 June 2026: a way past its access controls, a way to reach files outside their intended directory, and a way to run arbitrary commands, each independently rated the maximum CVSS 10.0. Chained together they gave an outsider root on the device without ever logging in, and CISA listed all three in its KEV catalogue the same day under a three-day Deadline, the first live use of BOD 26-04's top tier.
Ubiquiti shipped the fix in UniFi OS Server 5.0.8, but the software runs across Dream Machine and Cloud Key appliances deployed at millions of small businesses and managed service providers, where updating within three days of disclosure is rarely realistic.