CVE-2026-34909
Description
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.
In plain language
AI Act nowCVE-2026-34909 is a network-based file-sneaking weakness in UniFi OS that attackers are already using to steal control of accounts; if your business runs UniFi OS on your network gear, you should act now.
CVE-2026-34909 is a path traversal flaw in UniFi OS Server (and related UniFi OS devices) that allows an unauthenticated network attacker to access and manipulate underlying system files, enabling takeover by reaching an underlying account mechanism; it is confirmed listed in CISA KEV and has been reported exploited in the wild to create rogue administrator accounts.
What to do now
- Check whether your business uses UniFi OS Server, express, udm, udm-pro, udm-se, udm-pro-max, udm-beast, efg, udw, or udr (and which exact version is installed).
- If any of these are on versions earlier than the fixed releases below, plan an upgrade immediately.
- Upgrade to the fixed versions: UniFi OS Server 5.0.8, express 4.0.14, udm/udm-pro/udm-se/udm-pro-max/efg/udw/udr/udr7/udr-5g 5.1.12 (and udm-beast 5.1.11).
- After upgrading, review UniFi OS admin accounts and recent admin changes for unexpected accounts (e.g., the reported “John Sim” username) and remove anything suspicious.
- If you cannot upgrade right away, follow the vendor’s mitigation guidance from the Security Advisory Bulletin and CISA KEV instructions (or discontinue use if mitigations are unavailable).
CVSS Vector Breakdown
AV:NAttack VectorAC:LAttack ComplexityPR:NPrivileges RequiredUI:NUser InteractionS:CScopeC:HConfidentialityI:HIntegrityA:HAvailabilityWeaknesses
Affected Products
Exploitability
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Attack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
2 techniquesReferences
- Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OSen·The Hacker News·
- 29th June – Threat Intelligence Reporten-us·Check Point Research·
- CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploiteden·The Hacker News·
- CISA warns of max severity Ubiquiti flaws exploited in attacksen-us·BleepingComputer·
- Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairsen-us·SecurityWeek·
- CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalogen-us·Daily CyberSecurity (securityonline.info)· Summary only·
- ⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and Moreen·The Hacker News· Summary only·
- Critical UniFi OS bug lets hackers gain root without authenticationen-us·BleepingComputer· Summary only·
- ⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and Moreen·The Hacker News· Summary only·
- Popping Root on UniFi OS Server: Unauthenticated RCE Chain Detection & Analysisen-us·Bishop Fox·
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-34909 and every CVE in our database. Create a free account — no credit card required.
Create Free Account