CVE-2026-34910

Published May 22, 2026

Last updated 21 days ago

Exploit knownCVSS critical 10.0
IoT
SSH
Network
ICS
Server
Wlan
Firmware

Overview

Description
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
Source
support@hackerone.com
NVD status
Analyzed
Products
unifi_os_server, unifi_cloud_gateway_industrial_firmware, unifi_dream_machine_firmware, unifi_dream_machine_pro_firmware, unifi_dream_machine_special_edition_firmware, unifi_dream_machine_pro_max_firmware, enterprise_fortress_gateway_firmware, unifi_dream_wall_firmware, unifi_dream_router_firmware, unifi_dream_router_7_firmware, unifi_express_7_firmware, unifi_network_video_recorder_firmware, unifi_network_video_recorder_pro_firmware, unifi_network_video_recorder_instant_firmware, enterprise_network_video_recorder_firmware, unifi_cloud_gateway_ultra_firmware, unifi_cloud_gateway_max_firmware, unifi_cloud_gateway_fiber_firmware, unifi_dream_router_5g_max_firmware, enterprise_network_video_recorder_core_firmware, unifi_cloud_key_plus_firmware, unifi_cloudkey_firmware, unifi_cloudkey_enterprise_firmware, unifi_network_video_recorder_g2_firmware, unifi_network_video_recorder_g2_pro_firmware, unifi_dream_machine_beast_firmware, unas_2_firmware, unas_4_firmware, unas_pro_firmware, unas_pro_4_firmware, unas_pro_8_firmware

Risk scores

CVSS 3.1

Type
Secondary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Ubiquiti UniFi OS Improper Input Validation Vulnerability
Exploit added on
Jun 23, 2026
Exploit action due
Jun 26, 2026
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

support@hackerone.com
CWE-20

Social media

Hype score
Not currently trending
  1. 00:00 UTC: CVE-2026-34910 disclosed. CISA: CVE-2026-34910 added to Known Exploited Vulnerabilities — Ubiquiti UniFi OS Status: ✅ Confirmed exploited in the wild Date added: 2026-06-23 Required action: Apply mitigations in accordance with vendor instructions, ensuring…

    @lyrie_ai

    14 Jul 2026

    63 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  2. ⚠️ Vulnerabilidades en productos Ubiquiti ❗ CVE-2026-34910 ❗ CVE-2026-34909 ❗ CVE-2026-34908 ➡️ Más info: https://t.co/FNt81NNLGw https://t.co/XXmcjL5qWk

    @CERTpy

    8 Jul 2026

    206 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CISA issues warning for 3 exploited CVSS 10 vulns. Info, incl. fix info, at SecAlerts: CVE-2026-34908: https://t.co/fXlPtXlaHh CVE-2026-34909: https://t.co/n2mkg9dnON CVE-2026-34910: https://t.co/FsJe5FE35X #ciso #cio #cto #vulnerabilities #cybersecurity #msp #mssp #secalerts

    @SecAlertsCo

    26 Jun 2026

    126 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  4. Warning: Three critical, actively exploited #vulnerabilities in #ubiquity #uniFiOS #CVE-2026-34908 #CVE-2026-34909 #CVE-2026-34910 CVSS: 10. Read our updated advisory at https://t.co/tyXkhKlqo0 and #Patch #Patch #Patch

    @CCBalert

    25 Jun 2026

    685 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. 🚨 CRITICAL: CVE-2026-34910 (CVSS TBD) - Ubiquiti UniFi OS improper input validation flaw enables command injection for network-adjacent attackers. Added to CISA KEV—patch immediately. Remediation due: June 26, 2026. #CVE #PatchNow #ThreatIntel https://t.co/N8cY8ePA6R

    @DFIR_Lab

    23 Jun 2026

    74 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. 🚨 Ubiquiti UniFi OS devices can be taken over without a password. CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910: CVSS 10.0 each, added to CISA KEV on June 23. Federal patch deadline: June 26, 2026. 🧵 #CVE #KEV https://t.co/F5zTCv6jyW

    @cloudkey_tech

    23 Jun 2026

    54 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

  7. 🚨 4 new CISA KEV adds today CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2025-67038 https://t.co/0StDFCzdCI #boarnet #cybersecurity #cisakev #cve #threatintelligence #malware

    @boarnetio

    23 Jun 2026

    63 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. The security issues are tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. They have been addressed in May and impact UniFi OS Server versions 5.0.6 and earlier. https://t.co/crmGei8ucH

    @jbhall56

    9 Jun 2026

    34 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. 🚨新たなShai-Huludサプライチェーン攻撃で科学分野の人気PyPIパッケージ19件が侵害される ⚠️UniFi OSの重大な脆弱性により、認証なしでrootを取得することが可能に(CVE-2026-34908、CVE-2026-34909、CVE-2026-34910) 〜

    @MachinaRecord

    9 Jun 2026

    112 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. Ubiquiti UniFi OS server vulnerabilities allow unauthenticated remote code execution https://t.co/82l4jQDkYj The security flaws, tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, were addressed in May and impacted UniFi OS Server versions 5.0.6 and earlier.

    @f1tym1

    8 Jun 2026

    56 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. Three chained CVEs (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) allow unauthenticated RCE with root on Ubiquiti UniFi OS Server 5.0.6 and earlier. Upgrade to 5.0.8+ and use Bishop Fox's detection script to check for compromise. #DFIR_Radar https://t.co/oqryQS4i0R

    @DFIR_Radar

    8 Jun 2026

    173 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  12. Ubiquiti社UniFi OSでCVSSスコア10の脆弱性3件が修正。認証ゲートウェイ回避のCVE-2026-34908及びCVE-2026-34909、並びにパッケージ更新サービスでのコマンドインジェクションCVE-2026-34910。Bishop Fox社からrootシェルを取れる

    @__kokumoto

    8 Jun 2026

    2026 Impressions

    6 Retweets

    14 Likes

    9 Bookmarks

    0 Replies

    0 Quotes

  13. ⚠️ Vulnerabilidades en productos Ubiquiti ❗ CVE-2026-34910 ❗ CVE-2026-34909 ❗ CVE-2026-34908 ➡️ Más info: https://t.co/fD9rCbaHcM https://t.co/RRhKZMHess

    @CERTpy

    3 Jun 2026

    97 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. Warning: #Ubiquiti has released a security advisory bulletin addressing multiple critical vulnerabilities in #UniFi OS, including CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-33000. Risks ranges from unauthorised changes to command injection: https://t.co/mwPib2vEpg

    @CCBalert

    26 May 2026

    220 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. 【UniFi OSに最大深刻度の脆弱性、公開管理面は早期更新を】 UbiquitiがUniFi OSの複数脆弱性を修正しました。特にCVE-2026-34908、CVE-2026-34909、CVE-2026-34910は最大深刻度として扱われています。

    @01ra66it

    26 May 2026

    294 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. 🚨 THREE maximum severity flaws (CVSS 10.0) in Ubiquiti UniFi OS. CVE-2026-34908 — Improper Access Control CVE-2026-34909 — Path Traversal CVE-2026-34910 — Command Injection 🔗 https://t.co/d95XqoeA4b #CyberSecurity #Ubiquiti #UniFi #CVE202634908 #CVE202634909 #CVE20

    @ThreatAft

    25 May 2026

    81 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. CVE-2026-34908, CVE-2026-34909 & CVE-2026-34910: Vulnerabilities in Ubiquiti UniFi OS, 10.0 rating 🔥🔥🔥 Three new vulnerabilities in Ubiquiti UniFi OS allow an network attacker to make unauthorized changes, access files and execute arbitrary command. It may cause to

    @Netlas_io

    23 May 2026

    1489 Impressions

    6 Retweets

    26 Likes

    14 Bookmarks

    0 Replies

    0 Quotes

Configurations