CVE-2026-34910

Think of your UniFi device like a small building’s security system that accepts messages over the network. This vulnerability lets an attacker send specially crafted messages that the system wrongly treats as instructions, so they can run commands and potentially gain control.

In real attacks, people report automated attempts that create hidden “administrator” access, which can then be used to change settings or disrupt your network.

This matters if you run UniFi OS devices such as UniFi OS Server and UniFi gateway/router-family firmware from the list in this bulletin. It is especially concerning because it does not require a login, and the attacker only needs network access.

Only treat it as a real risk if the device is reachable from the network you don’t control (for example, the public internet or any path an attacker can reach), or if the device’s network-facing services are exposed.

This is RED because CISA has added it to its KEV list and exploitation has been reported in the wild. Attackers are using it over the network without needing a login, and reports describe automated reconnaissance that leads to rogue administrator account creation.

You should upgrade on an urgent timeline, aligned with the CISA due date of 2026-06-26.