--- title: "Ubiquiti Express vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/ubiquiti/express type: product description: "Ubiquiti Express has 12 published CVEs, 1 in CISA KEV and 1 with public exploits." updated: 2026-09-22 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Ubiquiti Express vulnerabilities Vendor: [Ubiquiti](https://radicalnotion.ai/vendor/ubiquiti) - **Published CVEs:** 12 - **In CISA KEV:** 1 - **With a public exploit:** 1 - **With a patch:** 12 - **Average CVSS:** 8.5 - **First CVE:** 2026-05-22 - **Latest CVE:** 2026-09-22 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 5 | | High | 7 | | Medium | 0 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-787](https://radicalnotion.ai/cwe/cwe-787) | Out-of-bounds Write | 3 | | [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 2 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 2 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 2 | | [CWE-93](https://radicalnotion.ai/cwe/cwe-93) | Improper Neutralization of CRLF Sequences ('CRLF Injection') | 2 | | [CWE-674](https://radicalnotion.ai/cwe/cwe-674) | Uncontrolled Recursion | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2026 | 12 | ## Affected versions | Version | Kind | CVEs | | --- | --- | --- | | \< 4.0.21 | range | 6 | | \< 4.0.15 | range | 3 | | \< 4.0.17 | range | 2 | | \< 4.0.14 | range | 1 | | 4.0.21 | patched | 6 | | 4.0.15 | patched | 3 | | 4.0.17 | patched | 2 | | 4.0.14 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-95862 | - | high | 7.5 | No | No | Yes | | CVE-2026-95861 | - | high | 7.5 | No | No | Yes | | CVE-2026-77558 | - | high | 7.5 | No | No | Yes | | CVE-2026-77556 | - | high | 7.5 | No | No | Yes | | CVE-2026-77555 | - | high | 7.5 | No | No | Yes | | CVE-2026-77544 | - | high | 7.5 | No | No | Yes | | CVE-2026-77550 | - | critical | 10.0 | No | No | Yes | | CVE-2026-77549 | - | critical | 9.0 | No | No | Yes | | CVE-2026-47370 | - | critical | 9.9 | No | No | Yes | | CVE-2026-47369 | - | critical | 9.9 | No | No | Yes | | CVE-2026-47368 | - | high | 8.6 | No | No | Yes | | CVE-2026-34909 | - | critical | 10.0 | Yes | Yes | Yes | ## Frequently asked questions ### How many CVEs does Ubiquiti Express have? Ubiquiti Express has 12 published CVE records since 2026. ### How many Ubiquiti Express CVEs are in CISA KEV? 1 of Ubiquiti Express's CVEs is listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline. ### Are there public exploits for Ubiquiti Express vulnerabilities? Yes — 1 of Ubiquiti Express's CVEs have a known public exploit. ### Which versions of Ubiquiti Express are affected? 8 distinct Ubiquiti Express versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Ubiquiti Express CVEs? Ubiquiti Express's CVEs most often map to these CWE weakness types: CWE-787 (Out-of-bounds Write), CWE-125 (Out-of-bounds Read), CWE-20 (Improper Input Validation), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')). ### How many critical Ubiquiti Express vulnerabilities are there? Ubiquiti Express has 5 critical and 7 high-severity CVEs. ### What is the average severity of Ubiquiti Express CVEs? The average CVSS base score across Ubiquiti Express's scored CVEs is 8.5. ## Other products from this vendor - [Express 7](https://radicalnotion.ai/vendor/ubiquiti/express-7) (25 CVEs) - [UniFi OS Server](https://radicalnotion.ai/vendor/ubiquiti/unifi-os-server) (20 CVEs) - [Cloud Gateways](https://radicalnotion.ai/vendor/ubiquiti/cloud-gateways) (18 CVEs) - [Dream Machines](https://radicalnotion.ai/vendor/ubiquiti/dream-machines) (18 CVEs) - [Dream Routers](https://radicalnotion.ai/vendor/ubiquiti/dream-routers) (18 CVEs) - [Dream Wall](https://radicalnotion.ai/vendor/ubiquiti/dream-wall) (18 CVEs) - [UniFi Network Application](https://radicalnotion.ai/vendor/ubiquiti/unifi-network-application) (16 CVEs) - [EdgeRouter X](https://radicalnotion.ai/vendor/ubiquiti/edgerouter-x) (14 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/ubiquiti/express). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.