🔴 CVE-2026-34910

CVE-2026-34910 is a critical (CVSS 10.0) improper input validation vulnerability in Ubiquiti UniFi OS devices that enables unauthenticated remote command injection, granting attackers root-level control over network gateways, NVRs, and management appliances. It is confirmed as actively exploited in the wild (added to CISA KEV on 2026-06-23) and has been weaponized into Mirai-style botnet campaigns via unauthenticated RCE chains. Because these devices are commonly exposed to the internet for remote management, this represents a severe, directly internet-exploitable threat.

← Back to Overview
HIGH_RISK
Risk Level
10.0
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
HIGH
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-05-22

Added to CISA KEV: 2026-06-23 32 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-34910 is a critical improper input validation vulnerability (CWE-20) affecting various Ubiquiti UniFi OS devices. It allows a remote attacker with network access to inject and execute arbitrary operating system commands with elevated device privileges. Because this vulnerability grants attackers the ability to compromise the integrity and confidentiality of the entire networking system, it represents a significant security risk for any organization utilizing UniFi OS management infrastructure [2][6].

Exploitation

  • Active Exploitation: The vulnerability has been confirmed as being actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on June 23, 2026 [7].
  • Threat Actors: While specific named threat actors are currently being tracked, the exploit has been utilized in chains to achieve unauthenticated remote code execution (RCE) [4][5].
  • Availability: Proof-of-concept information and research detailing how to chain this vulnerability for root-level access are publicly available [5].
  • Prerequisites: Exploitation requires network access to the affected device. While initially described as requiring high privileges, researchers have demonstrated that it can be chained with other vulnerabilities to facilitate unauthenticated access [1][4].

Affected Products & Patches

  • Affected Products: Ubiquiti UniFi OS devices (specific hardware and software versions are detailed in the official vendor security advisory) [1].
  • Patches: Ubiquiti has released security updates to address this vulnerability; administrators should review the official Security Advisory Bulletin 064 for the specific patched firmware versions [1].
  • Mitigations: Organizations that cannot patch immediately should restrict network access to UniFi OS management interfaces, ensuring they are not exposed to the public internet, and monitor logs for unauthorized command execution attempts.

Impact

  • Capability: Successful exploitation allows an attacker to execute arbitrary system commands, effectively granting them full control (root access) over the device [2][5].
  • Business Risk: For internet-facing deployments, this vulnerability poses a severe risk, as it allows attackers to completely compromise the underlying network infrastructure, potentially leading to data exfiltration, lateral movement within the network, and the disruption of critical business operations [3].

Sources

  1. Security Advisory Bulletin 064

    A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS ...

  2. CVE-2026-34910 - Vulnerability Details - OpenCVE

    Impact The vulnerability is an Improper Input Validation flaw (CWE-20) that allows a malicious actor with network access to supply crafted data to a UniFi OS device and cause it to execute arbitrary operating system commands with device privileges. This flaw enables the execution of commands supplie…

  3. TIER_2_CVE-2026-34910.md - GitHub

    CVE-2026-34910 is a Command Injection vulnerability classified under CWE-20 ("Improper Input Validation"). It affects Ubiquiti's UniFi OS devices, which are used for managing networking equipment and security systems. The flaw allows an attacker with network access and high privileges to execute arb…

  4. Ubiquiti UniFi OS RCE

    What is the Vulnerability?Multiple critical vulnerabilities affecting Ubiquiti UniFi OS can be chained together to achieve unauthenticated ...

  5. Popping Root on UniFi OS Server: Unauthenticated RCE…

    Bishop Fox confirmed a full unauthenticated RCE chain in UniFi OS Server that lands a root shell in one request, exposing networks, doors, ...

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed