CVE-2026-33000General(ui / unifi_os_server)

LOWCVSS 9.1 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch ui unifi_os_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

ui CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b

Weakness type (CWE)

CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

unifi_os_server

Threat summary

Patch or workaround signal is available
7 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
General: 3 classified signals
Disclosure: 2 classified signals
Peaked at 3 mentions on most recent observed day (2026-06-08)
7 total mentions across 4 days

Affected systems

Vendors

Products

unifi_os_server

Deep dive

Activity timeline7 mentions / 4d

Signal classification3 categories

General

342.9%

Disclosure

228.6%

Patch

228.6%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-22	2	Disclosure1Patch1
2026-05-23	1	Patch1
2026-05-26	1	Disclosure1
2026-06-08	3	General3

Full discourse7 posts

Elusive@ElusivePrivacy140d
Patch
Ubiquiti patches three max-severity UniFi OS RCEs 🔒 Ubiquiti released patches for three maximum-severity vulnerabilities in UniFi OS all exploitable remotely without authentication. One confirmed as CVE-2026-33000 (command injection via improper input validation). Nearly 100,000 UniFi endpoints are internet-exposed per Censys. Patch immediately these will be reverse-engineered fast. Source: BleepingComputer / Ubiquiti advisory Full analysis → http://t.me/VulnerabilityNews Follow @VulnerabilityNw
Post summary
Ubiquiti has released patches for three critical UniFi OS RCE vulnerabilities, notably CVE‑2026‑33000, with detailed technical info but no evidence of current exploitation or available PoC tools.
11010166
182 followersView on X
CCB Alert@CCBalert136d
Disclosure
Warning: #Ubiquiti has released a security advisory bulletin addressing multiple critical vulnerabilities in #UniFi OS, including CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-33000. Risks ranges from unauthorised changes to command injection: https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
Post summary
Ubiquiti has issued a security advisory for several critical CVEs, outlining risks from unauthorized changes up to command injection and directing readers to the advisory for details.
01000279
7.2K followersView on X
Dave@RideToFireStar123d
General
Yawn 🥱 2026 recap: UniFi OS: - CVE-2026-34908 - 10 - CVE-2026-34909 - 10 - CVE-2026-34910 - 10 - CVE-2026-33000 - 9.1 - CVE-2026-34911 - 7.7 UniFi Play Devices: - CVE-2026-22563 - 9.8 - CVE-2026-22562 - 9.8 - CVE-2026-22564 - 9.8 - CVE-2026-22566 - 7.5 - CVE-2026-22565 - 7.5 UniFi Network (Controller): - CVE-2026-22557 - 10 - CVE-2026-22558 - 7.7 - CVE-2026-22559 - 8.8 UniFi Protect: - CVE-2026-21633 - 8.8 - CVE-2026-21634 - 6.5 UniFi airMAX: - CVE-2026-21638 - 8.8 So much fail, and we're not even halfway through 2026. Lots of 10s and 9s. 🤡🩰
Post summary
The post lists numerous UniFi-related CVEs with their severity scores but abstains from providing any additional technical, exploit, or mitigation details.
00000116
1.2K followersView on X
Dave@RideToFireStar123d
General
Yawn 🥱 2026 recap: UniFi OS: - CVE-2026-34908 - 10 - CVE-2026-34909 - 10 - CVE-2026-34910 - 10 - CVE-2026-33000 - 9.1 - CVE-2026-34911 - 7.7 UniFi Play Devices: - CVE-2026-22563 - 9.8 - CVE-2026-22562 - 9.8 - CVE-2026-22564 - 9.8 - CVE-2026-22566 - 7.5 - CVE-2026-22565 - 7.5 UniFi Network (Controller): - CVE-2026-22557 - 10 - CVE-2026-22558 - 7.7 - CVE-2026-22559 - 8.8 UniFi Protect: - CVE-2026-21633 - 8.8 - CVE-2026-21634 - 6.5 UniFi airMAX: - CVE-2026-21638 - 8.8 So much fail, and we're not even halfway through 2026. Lots of 10s and 9s. 🤡🩰
Post summary
The post enumerates several UniFi CVEs with their CVSS scores but offers no PoC, exploit, patch information, or evidence of active exploitation.
0000057
1.2K followersView on X
Dave@RideToFireStar123d
General
Yawn 🥱 2026 recap: UniFi OS: - CVE-2026-34908 - 10 - CVE-2026-34909 - 10 - CVE-2026-34910 - 10 - CVE-2026-33000 - 9.1 - CVE-2026-34911 - 7.7 UniFi Play Devices: - CVE-2026-22563 - 9.8 - CVE-2026-22562 - 9.8 - CVE-2026-22564 - 9.8 - CVE-2026-22566 - 7.5 - CVE-2026-22565 - 7.5 UniFi Network (Controller): - CVE-2026-22557 - 10 - CVE-2026-22558 - 7.7 - CVE-2026-22559 - 8.8 UniFi Protect: - CVE-2026-21633 - 8.8 - CVE-2026-21634 - 6.5 UniFi airMAX: - CVE-2026-21638 - 8.8 So much fail, and we're not even halfway through 2026. Lots of 10s and 9s. 🤡🩰
Post summary
The post enumerates multiple UniFi CVEs with high CVSS scores but offers no additional content regarding exploits, patches, or technical specifics.
00000110
1.2K followersView on X
ToolsLib@ToolsLib140d
Patch
Ubiquiti UniFi OS critical fixes: CVE-2026-33000 and related flaws https://blog.toolslib.net/2026/05/22/ubiquiti-unifi-os-cve-2026-33000-bulletin-064/
Post summary
The linked bulletin announces critical fixes for CVE‑2026‑33000 and related flaws in Ubiquiti UniFi OS, suggesting users should review and apply the upcoming patch.
00000113
543 followersView on X
CVE@CVEnew141d
Disclosure
CVE-2026-33000 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Comma… https://www.cve.org/CVERecord?id=CVE-2026-33000
Post summary
The post announces CVE‑2026‑33000, describing an improper input validation flaw in UniFi OS devices that could allow command execution with high privileges, but it does not provide exploit details or remediation information.
00000185
57.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ui	unifi_os_server	-	-	-

Explore more

Back to dashboard ui CVEs unifi_os_server vulnerabilities

What researchers are saying

CVE-2026-33000

Elusive[verified]@ElusivePrivacyPatch

Ubiquiti has released patches for three critical UniFi OS RCE vulnerabilities, notably CVE‑2026‑33000, with detailed technical info but no evidence of current exploitation or available PoC tools.

Dave[verified]@RideToFireStarGeneral

The post lists numerous UniFi-related CVEs with their severity scores but abstains from providing any additional technical, exploit, or mitigation details.

Dave[verified]@RideToFireStarGeneral

The post enumerates several UniFi CVEs with their CVSS scores but offers no PoC, exploit, patch information, or evidence of active exploitation.

Dave[verified]@RideToFireStarGeneral

The post enumerates multiple UniFi CVEs with high CVSS scores but offers no additional content regarding exploits, patches, or technical specifics.

CCB Alert@CCBalertDisclosure

Ubiquiti has issued a security advisory for several critical CVEs, outlining risks from unauthorized changes up to command injection and directing readers to the advisory for details.

ToolsLib@ToolsLibPatch

The linked bulletin announces critical fixes for CVE‑2026‑33000 and related flaws in Ubiquiti UniFi OS, suggesting users should review and apply the upcoming patch.

CVE@CVEnewDisclosure

The post announces CVE‑2026‑33000, describing an improper input validation flaw in UniFi OS devices that could allow command execution with high privileges, but it does not provide exploit details or remediation information.