This vulnerability (CVE-2026-33000) affects UniFi OS Server by Ubiquiti Inc and is classified as CWE-20 (Improper Input Validation). It enables an attacker who already has high privileges and network access to inject commands on the affected system. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. The vendor has not provided a patch or official remediation level as of the publication date.

Successful exploitation can lead to command injection, allowing an attacker to execute arbitrary commands on the UniFi OS Server. This can result in full compromise of the device, including unauthorized access, data manipulation, and denial of service. The vulnerability requires the attacker to have high privileges and network access, limiting the attack surface to trusted or internal networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to UniFi OS Server devices to trusted administrators only and monitor for suspicious activity. Avoid granting unnecessary high privileges to users on the network to reduce risk.