<![CDATA[Ubiquiti patches three max severity security vulnerabilities]]>Ubiquiti has shipped patches addressing three maximum-severity security flaws, all of which can be exploited remotely without requiring any privileges. The vulnerabilities impact specific product lines and have been assigned the highest possible severity rating, indicating they pose an immediate risk to exposed devices.

The flaws were discovered in firmware components that handle network authentication and device management. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code or take full control of affected hardware. Ubiquiti has not released detailed technical write-ups yet, but administrators are strongly urged to apply the available firmware updates immediately.

The affected products and their patched firmware versions are as follows:

  • UniFi Cloud Key Gen2 and Gen2 Plus — update to firmware 3.2.16
  • UniFi Dream Machine and Dream Machine Pro — update to firmware 3.2.16
  • UniFi Network Application (self-hosted) — update to 8.0.7

Ubiquiti’s advisory notes that no workarounds are available, so updating to the listed versions is the only reliable mitigation. Devices left unpatched are exposed to remote compromise, especially if management interfaces are reachable from the internet. The company recommends enabling automatic updates and restricting administrative access to trusted networks as additional hardening steps.

If you manage any of these devices, review your firmware version and schedule the upgrade as soon as possible, ideally outside peak hours to minimise disruption.

Source: BleepingComputer

Are any of your UniFi devices currently exposed to the internet, or are you already enforcing a strict update schedule for them?

]]>https://xploitlk.com/topic/113/ubiquiti-patches-three-max-severity-security-vulnerabilitiesRSS for NodeSat, 05 Sep 2026 14:23:14 GMTThu, 27 Aug 2026 00:30:21 GMT60