CVE-2026-34908

Published May 22, 2026

Last updated 20 days ago

Exploit knownCVSS critical 10.0
ICS
IoT
Server
Firmware
Wlan

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-34908 is an Improper Access Control vulnerability (CWE-284) affecting Ubiquiti UniFi OS devices. Disclosed on May 21, 2026, this flaw allows a malicious actor with network access to bypass access restrictions and make unauthorized changes to the system. The vulnerability does not require authentication or user interaction for exploitation. This issue impacts various Ubiquiti UniFi OS devices, including models such as UDM, UDM-Pro, UDM-SE, and UDM-Pro-Max systems. Ubiquiti has released security updates to address this vulnerability.

Description
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
Source
support@hackerone.com
NVD status
Analyzed
Products
unifi_os_server, unifi_cloud_gateway_industrial_firmware, unifi_dream_machine_firmware, unifi_dream_machine_pro_firmware, unifi_dream_machine_special_edition_firmware, unifi_dream_machine_pro_max_firmware, enterprise_fortress_gateway_firmware, unifi_dream_wall_firmware, unifi_dream_router_firmware, unifi_dream_router_7_firmware, unifi_express_7_firmware, unifi_network_video_recorder_firmware, unifi_network_video_recorder_pro_firmware, unifi_network_video_recorder_instant_firmware, enterprise_network_video_recorder_firmware, unifi_cloud_gateway_ultra_firmware, unifi_cloud_gateway_max_firmware, unifi_cloud_gateway_fiber_firmware, unifi_dream_router_5g_max_firmware, enterprise_network_video_recorder_core_firmware, unifi_cloud_key_plus_firmware, unifi_cloudkey_firmware, unifi_cloudkey_enterprise_firmware, unifi_network_video_recorder_g2_firmware, unifi_network_video_recorder_g2_pro_firmware, unifi_dream_machine_beast_firmware, unas_2_firmware, unas_4_firmware, unas_pro_firmware, unas_pro_4_firmware, unas_pro_8_firmware

Risk scores

CVSS 3.1

Type
Secondary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Ubiquiti UniFi OS Improper Access Control Vulnerability
Exploit added on
Jun 23, 2026
Exploit action due
Jun 26, 2026
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

support@hackerone.com
CWE-284

Social media

Hype score
Not currently trending
  1. 00:00 UTC: CVE-2026-34908 disclosed. CISA: CVE-2026-34908 added to Known Exploited Vulnerabilities — Ubiquiti UniFi OS Status: ✅ Confirmed exploited in the wild Date added: 2026-06-23 Required action: Apply mitigations in accordance with vendor instructions, ensuring…

    @lyrie_ai

    14 Jul 2026

    33 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  2. ⚠️ Vulnerabilidades en productos Ubiquiti ❗ CVE-2026-34910 ❗ CVE-2026-34909 ❗ CVE-2026-34908 ➡️ Más info: https://t.co/FNt81NNLGw https://t.co/XXmcjL5qWk

    @CERTpy

    8 Jul 2026

    206 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CVE-2026-34908: 🚨The UniFi OS Server RCE chain (CVE-2026-34908/34909/34910) is now being actively exploited Bishop Fox researchers discovered it is possible to chain three vulnerabilities together to achieve unauthenticated remote code execution as root - this is now…

    @lyrie_ai

    6 Jul 2026

    48 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  4. Top #CVE to #patch this week 👀 - @Ubiquiti UniFi OS (CVE-2026-34908, 34909, 34910) critical flaws - @Cisco UCM (CVE-2026-20230) SSRF to root - Another two @Linux Privesc pedit COW(CVE-2026-46331), DirtyClone - @Linux kernel — new DirtyFrag family privesc, JFrog published

    @stansecure

    2 Jul 2026

    120 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  5. CISA issues warning for 3 exploited CVSS 10 vulns. Info, incl. fix info, at SecAlerts: CVE-2026-34908: https://t.co/fXlPtXlaHh CVE-2026-34909: https://t.co/n2mkg9dnON CVE-2026-34910: https://t.co/FsJe5FE35X #ciso #cio #cto #vulnerabilities #cybersecurity #msp #mssp #secalerts

    @SecAlertsCo

    26 Jun 2026

    126 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  6. Warning: Three critical, actively exploited #vulnerabilities in #ubiquity #uniFiOS #CVE-2026-34908 #CVE-2026-34909 #CVE-2026-34910 CVSS: 10. Read our updated advisory at https://t.co/tyXkhKlqo0 and #Patch #Patch #Patch

    @CCBalert

    25 Jun 2026

    685 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. 🚨 CISA KEV Catalog Update June 2026 (status on 24.06.2026) - actively exploited vulnerabilities in the database: 🔹 Ubiquiti UniFi OS: CVE-2026-34908/34909/34910 (due 6/26) 🔹 Lantronix EDS5000: CVE-2025-67038 (due 6/26) 🔹 Splunk Enterprise: CVE-2026-20253 (due 6/21)

    @techepages

    24 Jun 2026

    104 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs https://t.co/HvSOIqzr4n Threat actors have been targeting three critical-severity vulnerabilities in Ubiquiti devices, the US cybersecurity agency CISA warns. The exploited flaws, tracked as CVE-2026-34908, CVE-2026-

    @nims213

    24 Jun 2026

    32 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. Today’s CTI call: patch/exposure beats actor-label hunting. CISA added 4 actively exploited device/control-plane bugs to KEV: - Ubiquiti UniFi OS: CVE-2026-34908 / 34909 / 34910 - Lantronix EDS5000: CVE-2025-67038 Treat this as immediate asset inventory + management-plane

    @alphahunt_io

    24 Jun 2026

    112 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    1 Quote

  10. 🚨 CISA adds Ubiquiti UniFi OS vulnerabilities to its KEV catalog, CVE-2026-34908 (access control flaw) is being actively exploited in the wild, allowing attackers to alter configs and disable security controls. ⚠️ Two more flaws (path traversal CVE-2026-34909, command inj

    @techepages

    24 Jun 2026

    65 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. CISAが既知の悪用された脆弱性4件をカタログに追加 CISA Adds Four Known Exploited Vulnerabilities to Catalog #CISA (Jun 23) CVE-2025-67038 Lantronix EDS5000のコードインジェクション脆弱性 CVE-2026-34908 Ubiquiti UniFi OSの不適切なアクセ

    @foxbook

    24 Jun 2026

    290 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  12. 🚨 CRITICAL: CVE-2026-34908 in Ubiquiti UniFi OS Improper access control flaw allows unauthorized system changes via network access. CISA KEV listed—actively exploited. Patch by June 26, 2026. #CVE #PatchNow #ThreatIntel https://t.co/aEeVd4t9GP

    @DFIR_Lab

    24 Jun 2026

    77 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. 米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに、Lantronix EDS5000のCVE-2025-67038とUbiquiti UniFi OSのCVE-2026-34908~34910の4件を追加。対処期限はいずれも3日後の6/26。ランサム

    @__kokumoto

    23 Jun 2026

    1045 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

  14. 🚨 Ubiquiti UniFi OS devices can be taken over without a password. CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910: CVSS 10.0 each, added to CISA KEV on June 23. Federal patch deadline: June 26, 2026. 🧵 #CVE #KEV https://t.co/F5zTCv6jyW

    @cloudkey_tech

    23 Jun 2026

    54 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

  15. 🚨 4 new CISA KEV adds today CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2025-67038 https://t.co/0StDFCzdCI #boarnet #cybersecurity #cisakev #cve #threatintelligence #malware

    @boarnetio

    23 Jun 2026

    63 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. The security issues are tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. They have been addressed in May and impact UniFi OS Server versions 5.0.6 and earlier. https://t.co/crmGei8ucH

    @jbhall56

    9 Jun 2026

    34 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. 🚨新たなShai-Huludサプライチェーン攻撃で科学分野の人気PyPIパッケージ19件が侵害される ⚠️UniFi OSの重大な脆弱性により、認証なしでrootを取得することが可能に(CVE-2026-34908、CVE-2026-34909、CVE-2026-34910) 〜

    @MachinaRecord

    9 Jun 2026

    112 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  18. Ubiquiti UniFi OS server vulnerabilities allow unauthenticated remote code execution https://t.co/82l4jQDkYj The security flaws, tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, were addressed in May and impacted UniFi OS Server versions 5.0.6 and earlier.

    @f1tym1

    8 Jun 2026

    56 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  19. Three chained CVEs (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) allow unauthenticated RCE with root on Ubiquiti UniFi OS Server 5.0.6 and earlier. Upgrade to 5.0.8+ and use Bishop Fox's detection script to check for compromise. #DFIR_Radar https://t.co/oqryQS4i0R

    @DFIR_Radar

    8 Jun 2026

    173 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  20. Ubiquiti社UniFi OSでCVSSスコア10の脆弱性3件が修正。認証ゲートウェイ回避のCVE-2026-34908及びCVE-2026-34909、並びにパッケージ更新サービスでのコマンドインジェクションCVE-2026-34910。Bishop Fox社からrootシェルを取れる

    @__kokumoto

    8 Jun 2026

    2026 Impressions

    6 Retweets

    14 Likes

    9 Bookmarks

    0 Replies

    0 Quotes

  21. ⚠️ Vulnerabilidades en productos Ubiquiti ❗ CVE-2026-34910 ❗ CVE-2026-34909 ❗ CVE-2026-34908 ➡️ Más info: https://t.co/fD9rCbaHcM https://t.co/RRhKZMHess

    @CERTpy

    3 Jun 2026

    97 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  22. Warning: #Ubiquiti has released a security advisory bulletin addressing multiple critical vulnerabilities in #UniFi OS, including CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-33000. Risks ranges from unauthorised changes to command injection: https://t.co/mwPib2vEpg

    @CCBalert

    26 May 2026

    220 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  23. 【UniFi OSに最大深刻度の脆弱性、公開管理面は早期更新を】 UbiquitiがUniFi OSの複数脆弱性を修正しました。特にCVE-2026-34908、CVE-2026-34909、CVE-2026-34910は最大深刻度として扱われています。

    @01ra66it

    26 May 2026

    294 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  24. 🚨 THREE maximum severity flaws (CVSS 10.0) in Ubiquiti UniFi OS. CVE-2026-34908 — Improper Access Control CVE-2026-34909 — Path Traversal CVE-2026-34910 — Command Injection 🔗 https://t.co/d95XqoeA4b #CyberSecurity #Ubiquiti #UniFi #CVE202634908 #CVE202634909 #CVE20

    @ThreatAft

    25 May 2026

    81 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  25. Top 5 Trending CVEs: 1 - CVE-2025-49113 2 - CVE-2026-26980 3 - CVE-2026-31635 4 - CVE-2026-34908 5 - CVE-2026-42897 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    25 May 2026

    154 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  26. CVE-2026-34908, CVE-2026-34909 & CVE-2026-34910: Vulnerabilities in Ubiquiti UniFi OS, 10.0 rating 🔥🔥🔥 Three new vulnerabilities in Ubiquiti UniFi OS allow an network attacker to make unauthorized changes, access files and execute arbitrary command. It may cause to

    @Netlas_io

    23 May 2026

    1489 Impressions

    6 Retweets

    26 Likes

    14 Bookmarks

    0 Replies

    0 Quotes

  27. 🚨 CRITICAL: CVE-2026-34908 (UniFi OS) CVSS 10.0 Unauthenticated attacker on the network can take unauthorized control actions via improper access control. Advisory: https://t.co/CElDsYHXqv #CVE #cybersecurity #infosec #ThreatIntel

    @tornikepa

    22 May 2026

    93 Impressions

    1 Retweet

    1 Like

    1 Bookmark

    0 Replies

    0 Quotes

Configurations