CVE-2026-34909: UniFi OS path traversal allows unauthenticated file access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 10.0, unauthenticated network reachability, CISA KEV listing, and very high EPSS make this an urgent patch-first issue.

What it is

UniFi OS devices contain a path traversal flaw (CWE-22) that lets a network-reachable attacker read files on the underlying system. Because the exposed files can be manipulated to reach an underlying account, the flaw can lead to full compromise of the device. The vendor has published a security advisory bulletin with patch information.

Impact

An attacker gains read access to arbitrary files on the underlying system and, by manipulating those files, can obtain access to an underlying account. The CVSS scope change (S:C) and high confidentiality, integrity and availability impact indicate potential full device compromise.

Attack surface

Reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N), so any host that can reach the affected UniFi OS interface can attempt the traversal. No credentials or victim action are required.

Exploitation

The vulnerability is listed in CISA KEV (added 2026-06-23, due 2026-06-26) and EPSS is 0.65044 (99.21st percentile), indicating active exploitation is expected or observed. A third-party reference tagged Exploit describes in-the-wild exploitation building a Mirai botnet, though that reference names a different CVE id.

What to do

• Apply the vendor patch from the Ubiquiti Security Advisory Bulletin 064 as the first action.
• If patching is not immediately possible, restrict network access to UniFi OS management interfaces and remove direct internet exposure.
• Follow CISA BOD 26-04 guidance for prioritizing this update and for cloud services, or discontinue use of the product if mitigations are unavailable.
• Rotate credentials for any accounts reachable through the underlying system after patching.
• Verify all listed UniFi OS, Dream Machine, Cloud Gateway, and UNVR firmware products are updated, not just the primary controller.

Detection

• Monitor web and application logs on UniFi OS devices for path traversal patterns such as ../ sequences or encoded variants in request paths.
• Alert on unexpected outbound connections from UniFi OS devices, which may indicate botnet enrollment or post-exploitation activity.
• Audit file access and account activity on the underlying system for reads of sensitive files or creation of new accounts.
• Check for unauthorized configuration changes or new administrative users on affected devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.