CVE-2026-34908 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-05-22

Added to CISA KEV: 2026-06-23 32 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review UniFi OS logs, check for unauthorized configuration changes, new admin accounts, unexpected processes/services, and signs of Mirai/botnet infection; verify system integrity and consider factory reset + reconfig if compromise is suspected.
Immediately update UniFi OS Server to 5.0.8+ and all appliances to their fixed versions (5.1.12 / 5.1.11 / 5.1.10 as applicable). Prioritize edge gateways (UDM/UCG/UDR) first.
Remove management/remote-access interfaces from direct internet exposure; restrict management access to VPN or trusted networks and disable unnecessary port-forwarding to the appliance.
Enable and monitor alerting for authentication anomalies and configuration changes; deploy egress filtering to detect botnet C2/beaconing.
Patch priority: EMERGENCY / IMMEDIATE (out-of-band) — actively exploited, unauthenticated, CVSS 10.0.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-34908 is a critical improper access control vulnerability affecting Ubiquiti Networks UniFi OS Server, which carries a CVSS score of 10.0. This vulnerability allows an unauthenticated remote attacker with network access to bypass authentication mechanisms and make unauthorized changes to the underlying system ^[1]^[3]. It serves as the primary entry point in an exploit chain that can lead to remote code execution (RCE) with root privileges, making it a severe risk for enterprise and home networks utilizing affected hardware ^[2]^[4].

Exploitation

Active Exploitation: The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild ^[6].
Tool Availability: Proof-of-concept (PoC) code and detection scripts are publicly available, including resources for security assessments ^[2]^[4].
Attack Prerequisites:

- Network access to the UniFi OS device is required. - No authentication is needed for initial exploitation. - No specific user interaction is required from legitimate administrators.

Affected Products & Patches

Affected Versions: The vulnerability impacts nearly all UniFi OS devices (e.g., UDM, UCG, and UNVR series) running vulnerable firmware versions prior to the fix ^[5].
Patch/Hotfix: The issue was addressed by Ubiquiti in UniFi OS Server version 5.0.8 and later; administrators are urged to update immediately ^[4]^[7].
Mitigation: The primary mitigation is applying the vendor-supplied firmware update. Devices should be removed from direct internet exposure if patching is delayed.

Impact

System Access: Successful exploitation provides attackers with the ability to modify system configurations, bypass security controls, and, when chained with other vulnerabilities (such as CVE-2026-34909 and CVE-2026-34910), achieve full remote code execution with root-level access ^[1].
Business Risk: For internet-facing deployments, this vulnerability represents an existential threat to network integrity, potentially allowing attackers to control networking equipment, intercept traffic, disable security logging, or pivot into the internal network.

Sources

CVE-2026-34908, CVE-2026-34909, CVE-2026-34910: Ubiquiti UniFi OS ...
CVE-2026-34908 (CVSS 10.0, CWE-284): An improper access control flaw allows unauthorized changes to the system without authentication. This is the initial entry point that bypasses all access controls, enabling the attacker to then leverage the path traversal and command injection.
Popping Root on UniFi OS Server: Unauthenticated RCE…
For this post, we focus on the unauthenticated chain (CVE-2026-34908 and CVE-2026-34909 into CVE-2026-34910), because it is the one an attacker ...
NVD-CVE-2026-34908
CVE-2026-34908 Detail Description A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
Safely detect whether a UniFi OS Server ...
Unauthenticated RCE reached via the bypass Fixed in UniFi OS Server 5.0.8. Yes. The detector is designed for production and assessment use:…
PSA: Update UniFi OS Now - Security Advisory Bulletin ...
Critical Vulns Including Unauthenticated RCE (CVE-2026-34908, 34909, 34910) Affecting Nearly All UDM/UCG/UNVR Devices … this vulnerability ...

🔴 CVE-2026-34908