UniFi OS Server Critical RCE Chain Allows Root Access Without Credentials

Cybersecuritynews •Tushar Subhra Dutta • June 8, 2026

A critical vulnerability chain in the UniFi OS Server software has put thousands of organizations at serious risk. Researchers confirmed that an attacker can gain full root access to affected devices without a single credential, turning one unauthenticated request into a complete system takeover. UniFi OS Server is the management platform for the UniFi family […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in UniFi OS Allows Unauthorized Root Access A critical vulnerability chain in UniFi OS Server has been disclosed, allowing unauthenticated remote code execution (RCE) and full root access. The vulnerabilities include an authentication-gateway bypass, a path-traversal mismatch, and a command-injection sink in the package-update service. Attackers can exploit these flaws by sending a single crafted HTTP request, compromising affected devices without needing any credentials. This issue affects thousands of organizations using UniFi OS Server, which is the management platform for the UniFi family of products. Security Advisory Bulletin 064 has been issued, highlighting the severity of the vulnerabilities. Organizations are urged to assess their systems and apply necessary mitigations. No specific CVEs have been mentioned yet, but the implications are significant for cybersecurity across affected sectors. 3 sources 70

Extracted Entities

UniFi OS Server Critical RCE Chain Allows Root Access Without Credentials

The full story

Extracted Entities

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)