Ubiquiti UniFi OS hit by three actively exploited zero-day weaknesses, CISA orders federal patch deadline
Anyone running Ubiquiti UniFi gear is exposed now. CISA added three actively exploited UniFi OS flaws to its Known Exploited Vulnerabilities catalog: improper access control, path traversal, weak input validation. Hardest hit: small offices and home setups with no one watching fo
Anyone running Ubiquiti UniFi network gear should treat this as urgent. The US Cybersecurity and Infrastructure Security Agency has added three UniFi OS vulnerabilities to its Known Exploited Vulnerabilities catalog, the list reserved for flaws that attackers are already using in real intrusions. The three weaknesses cover improper access control, a path traversal flaw and weak input validation. Together they give an attacker room to reach parts of a system that are supposed to be locked down. Federal civilian agencies were handed a fixed deadline to patch, a sign the agency treats this as immediate rather than theoretical. UniFi became popular because it is simple to set up and manage without a dedicated network engineer, which is also why so much of it now sits in small businesses, clinics, schools and home offices. Those are the environments least likely to have anyone reading logs or applying updates quickly, and that gap is exactly what active exploitation finds first. The practical step is straightforward: check which UniFi OS version is running and apply the latest update, since the gap between public disclosure and mass scanning is usually short.