# Unitree Robotics vulnerabilities & exploitation

> As of 2026-11-07, Threadlinqs tracks 6 Unitree Robotics CVEs, 0 in the CISA Known Exploited Vulnerabilities catalog, linked to 2 tracked threat campaigns.

**Data as of:** 2026-11-07

## Exploitation timeline

Threadlinqs has recorded 6 Unitree Robotics CVEs published between 2026-02-15 and 2026-10-15. The busiest month was 2026-02 (2 new CVEs). None of them is listed in CISA KEV yet.

## Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked Unitree Robotics CVEs.

- [CVE-2026-115995](https://intel.threadlinqs.com/cve/CVE-2026-115995) — CRITICAL 9.6 · EPSS 1.4% · 2026-10-24
- [CVE-2026-76639](https://intel.threadlinqs.com/cve/CVE-2026-76639) — HIGH 8.8 · EPSS 0.7% · 2026-08-27
- [CVE-2026-27509](https://intel.threadlinqs.com/cve/CVE-2026-27509) — HIGH 8 · EPSS 0.5% · 2026-02-26
- [CVE-2026-76640](https://intel.threadlinqs.com/cve/CVE-2026-76640) — HIGH 7.5 · EPSS 0.3% · 2026-08-27
- [CVE-2026-27510](https://intel.threadlinqs.com/cve/CVE-2026-27510) — CRITICAL 9.6 · EPSS 0.3% · 2026-02-26
- [CVE-2026-115996](https://intel.threadlinqs.com/cve/CVE-2026-115996) — LOW 3.7 · EPSS 0.2% · 2026-10-24

## Products affected

Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 2 distinct Unitree Robotics products are affected. The most frequently affected:

- Unitree Go2 — 4 CVEs
- G1 EDU — 2 CVEs

## Threat activity

2 tracked threat campaigns reference Unitree Robotics products or exploit Unitree Robotics CVEs:

- [UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in Unitree G1 EDU Humanoid Robot (CVE-2026-76639, CVE-2026-76640)](https://intel.threadlinqs.com/threat/TL-2026-2196) — CRITICAL — 2026-08-28
- [US FCC Bans Imported Advanced Robots Over Supply-Chain Risk and UniPwn-Class Takeover Vulnerabilities (CVE-2025-35027)](https://intel.threadlinqs.com/threat/TL-2026-1751) — HIGH — 2026-07-29

## How to prioritise Unitree Robotics patching

This order follows the data Threadlinqs holds for Unitree Robotics, not a generic severity checklist:

- No Unitree Robotics CVE is in CISA KEV yet, so rank by exploit probability instead.
- Outside KEV, the highest EPSS scores are [CVE-2026-115995](https://intel.threadlinqs.com/cve/CVE-2026-115995) (1.4%), [CVE-2026-76639](https://intel.threadlinqs.com/cve/CVE-2026-76639) (0.7%), [CVE-2026-27509](https://intel.threadlinqs.com/cve/CVE-2026-27509) (0.5%).
- 2 CVEs score Critical and 3 High on CVSS v3 (maximum 9.6, average 7.9); sequence these after KEV and high-EPSS items.
- 4 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

## About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-07 and refresh daily.

Canonical: https://intel.threadlinqs.com/vendors/unitree-robotics
All vendors: https://intel.threadlinqs.com/vendors
Full detection coverage and IOCs for threats exploiting Unitree Robotics products unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp