Improper Access Control in UniFi OS Devices by Ubiquiti
CVE-2026-34908

10CRITICAL

Key Information:

Vendor

Ubiquiti Inc

Status
Unifi Os Server
Udm
Udm-pro
Udm-se
Vendor
CVE Published:
22 May 2026

Badges

👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2026-34908?

CVE-2026-34908 is a significant vulnerability affecting UniFi OS devices developed by Ubiquiti Inc. This software is designed to manage networking hardware, providing functionalities such as network monitoring, management, and security. The vulnerability arises from improper access control mechanisms within these devices, permitting unauthorized users to execute changes to the system without appropriate permissions. The inability to enforce strict access controls can lead to a range of negative consequences for organizations, including unauthorized data manipulation, modification of system configurations, and exposure to further security threats.

The technical fabric of this vulnerability highlights the risks posed by allowing a malicious actor with local network access to exploit these deficiencies, potentially compromising the integrity and confidentiality of sensitive data managed by UniFi OS. As organizations increasingly rely on integrated network solutions, the implications of such vulnerabilities become more profound, as they can lead to extensive disruptions in service delivery and a breakdown of trust in the network's security protocols.

Potential impact of CVE-2026-34908

  1. Unauthorized System Modifications: The vulnerability enables malicious actors to alter system settings and configurations, which can lead to disruptions in network performance and stability. This can adversely affect business operations that rely on these networking devices.

  2. Data Breach Risks: Exploiting this vulnerability could facilitate unauthorized access to sensitive data, increasing the risk of data breaches. Without proper access controls, attackers may extract or manipulate confidential information undetected.

  3. Escalation of Further Attacks: Once an intruder gains access through this vulnerability, they may use it as a foothold to launch additional attacks, further compromising the organization's security infrastructure and potentially leading to widespread malware infections or ransomware incidents.

CISA has reported CVE-2026-34908

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-34908 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

EFG 0 < 5.1.12

ENVR 0 < 5.1.12

ENVR-Core 0 < 5.1.12

News Articles

favicon imageBleepingComputer

Critical UniFi OS bug lets hackers gain root without authentication

Attackers can chain three already fixed vulnerabilities in the Ubiquiti UniFi OS server to execute remote code with root privileges and without authentication.

References

https://community.ui.com/releases/Security-Advisory-Bulle...

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🦅

    CISA Reported

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by BleepingComputer

  • Vulnerability published

  • Vulnerability Reserved

.