Unauthenticated UniFi OS Server RCE Chain Grants Root Access

Researchers at Bishop Fox confirmed that multiple flaws in Ubiquiti UniFi OS Server can be chained into unauthenticated remote code execution that yields full root access on exposed systems. The attack combines an authentication bypass and path traversal in the Nginx/unifi-core request flow—tracked as CVE-2026-34908 and CVE-2026-34909—with a command injection bug in the package-update service, CVE-2026-34910, and can be triggered through a reachable web request against internet-facing management interfaces. Researchers said the chain was validated end-to-end and can also leverage overly permissive sudo rights to complete privilege escalation.

Successful exploitation can expose stored secrets, enable forged administrative sessions that may persist after patching, and create downstream risk for managed network gear, door-access systems, and surveillance cameras connected through the platform. Ubiquiti said fixes were released in patched UniFi OS Server versions, including protections such as URI normalization, stricter package-name validation, removal of shell-based backend behavior, and reduced passwordless sudo permissions. Defenders are being urged to patch immediately, rotate credentials and secrets, review systems for signs of prior compromise, and limit or remove public exposure of UniFi management interfaces.