← Vulnerability feed

Vulnerability record · CVE-2026-34908 · published 22 May 2026

CVE-2026-34908: Ubiquiti UniFi OS improper access control allows unauthorized system changes

Ui · Unifi Os Server

UniFi OS devices contain an improper access control flaw (CWE-284) that lets a network-reachable actor make unauthorized changes to the system. The CVSS 3.1 base score is 10.0 (critical) with a scope-changing vector, and CISA added it to KEV with a three-day remediation due date, so it warrants immediate action. The record does not specify affected firmware versions or the exact vulnerable component.

10.0 CVSS 3.1 Critical CISA KEV since 23 Jun 2026 EPSS 15% · top 3.4% CWE-284 · Improper access control
10.0CVSS 3.1 base score
15%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
31Affected product versions listed by NVD
3References, 1 tagged exploit
23 Jul 2026Last modified by NVD

Description

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 10.0 with scope change, unauthenticated network reach, KEV listing and very high EPSS probability make this an immediate patch-or-isolate case.

What it is

UniFi OS devices contain an improper access control flaw (CWE-284) that lets a network-reachable actor make unauthorized changes to the system. The CVSS 3.1 base score is 10.0 (critical) with a scope-changing vector, and CISA added it to KEV with a three-day remediation due date, so it warrants immediate action. The record does not specify affected firmware versions or the exact vulnerable component.

Impact

An unauthenticated attacker can modify system configuration without authorization, and the scope change means impact can extend beyond the vulnerable component to connected systems. Full confidentiality, integrity and availability impact is scored.

Attack surface

Reachable over the network with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Any internet- or network-exposed UniFi OS management interface is a candidate entry point.

Exploitation

Listed in CISA KEV (added 2026-06-23, due 2026-06-26) and EPSS 30-day probability is 0.852 (99.7th percentile), indicating active exploitation is expected or observed. A third-party reference is tagged Exploit, though the record does not confirm exploit code details.

What to do

  • Apply the vendor patch from Ubiquiti Security Advisory Bulletin 064 per CISA BOD 26-04 guidance.
  • If patching is not immediately possible, restrict network access to UniFi OS management interfaces and discontinue use where mitigations are unavailable.
  • Remove direct internet exposure of UniFi OS management ports; place management behind VPN or an allowlisted jump host.
  • Audit UniFi OS devices for unauthorized configuration changes and re-validate admin credentials and API keys.
  • Track the CISA KEV due date (2026-06-26) and report remediation status as required.

Detection

  • Monitor UniFi OS management interface logs for configuration changes from unexpected source IPs or without a preceding authenticated session.
  • Alert on inbound connections to UniFi OS management ports from the internet or untrusted network segments.
  • Baseline device configuration and alert on unexpected changes to admin accounts, network settings or firewall rules.
  • Hunt for the exploitation activity described in the third-party advisory reference and correlate with UniFi OS device telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2026-34908 to the Known Exploited Vulnerabilities catalog on 23 June 2026 as "Ubiquiti UniFi OS Improper Access Control Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 26 June 2026.

Affected products

31 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b PatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908 US Government Resource
https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/ ExploitThird Party Advisory

Track CVE-2026-34908 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-34909UniFi OS path traversal allows unauthenticated file accessUniFi OS devices contain a path traversal flaw (CWE-22) that lets a network-reachable attacker read files on the underlying system. Because the expos…KEVEPSS 1.8%analysed10.0CVE-2026-34910Ubiquiti UniFi OS input validation flaw allows command injectionUniFi OS devices contain an improper input validation vulnerability (CWE-20) that lets a network-reachable attacker inject and execute commands. It a…KEVEPSS 46%analysed8.8CVE-2026-55112Ui unifi dream machine pro firmware improper access control vulnerabilityA malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability f…EPSS 0.36%8.8CVE-2026-54404Ui unifi dream machine beast firmware sql injection vulnerabilityA malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi …EPSS 0.49%8.8CVE-2026-54401Ui unifi os server server-side request forgery (ssrf) vulnerabilityA malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such…EPSS 0.43%8.8CVE-2026-54402Ui unifi os server improper input validation vulnerabilityA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute…EPSS 1.8%8.6CVE-2026-54403Ui unifi os server path traversal vulnerabilityA malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authent…EPSS 0.77%7.7CVE-2026-34911Ui unifi os server path traversal vulnerabilityA malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access file…EPSS 0.59%

Source: NIST National Vulnerability Database (record CVE-2026-34908), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.