This vulnerability (CVE-2026-47367) in the UID Enterprise Agent from Ubiquiti Inc involves improper input validation (CWE-20) that can be exploited by an attacker with network access and low privileges to execute arbitrary commands on the host system. The issue enables command injection, potentially compromising the device fully. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, required low privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. No official patch or fix information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows an attacker with low privileges on the network to execute arbitrary commands on the host device running UID Enterprise Agent. This can lead to full compromise of the device, including complete loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Ubiquiti Inc's advisories for updates. Until a fix is available, restrict network access to the UID Enterprise Agent and limit privileges where possible to reduce exposure.