Loading story…
Multiple critical vulnerabilities in Ubiquiti UniFi OS can be chained to give an unauthenticated attacker remote code execution as root on exposed devices. Fortinet reported active in-the-wild exploitation of an exploit chain involving CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, combining authentication bypass, path traversal, access to protected resources, and arbitrary command execution. Researchers have publicly demonstrated the chain, raising the risk for organizations that use UniFi OS to manage gateways, network controllers, video surveillance, and access control systems.
CVE-2026-34909 is described as a CVSS 10.0 path traversal flaw that can expose sensitive files and enable account compromise, while CVE-2026-34910 is a CVSS 10.0 command injection bug affecting a wide range of UniFi hardware and the software-only UniFi OS Server. Ubiquiti addressed the issues in Security Advisory Bulletin 064 with firmware updates across product families, including UniFi OS 5.1.12 for many devices and other fixed releases for NAS, UDM Beast, and UniFi OS Server platforms. Defenders are being urged to patch immediately, limit management interfaces to trusted networks, review internet-exposed systems for compromise, and perform integrity checks because persistence may remain after remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
FortiGuard Labs reported that the UniFi OS vulnerability chain is being actively exploited in the wild. The affected deployments include systems managing enterprise gateways, network controllers, video surveillance, and access control infrastructure.
Researchers publicly demonstrated an exploit chain combining CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 to achieve unauthenticated remote code execution with root privileges on Ubiquiti UniFi OS. The chain uses authentication bypass, access to protected resources, and arbitrary OS command execution.
On 2026-05-21, Ubiquiti patched CVE-2026-34909 and CVE-2026-34910 in Security Advisory Bulletin 064 through firmware updates across multiple UniFi OS product families. The fixes addressed critical unauthenticated path traversal and command injection issues, alongside other vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
fortiguard.fortinet.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcecommunity.ui.com
Open sourcecommunity.ui.com
Open sourcecommunity.ui.com
Open sourcecommunity.ui.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **Bishop Fox** confirmed that multiple flaws in **Ubiquiti UniFi OS Server** can be chained into **unauthenticated remote code execution** that yields full **root** access on exposed systems. The attack combines an authentication bypass and path traversal in the Nginx/`unifi-core` request flow—tracked as `CVE-2026-34908` and `CVE-2026-34909`—with a command injection bug in the `package-update` service, `CVE-2026-34910`, and can be triggered through a reachable web request against internet-facing management interfaces. Researchers said the chain was validated end-to-end and can also leverage overly permissive sudo rights to complete privilege escalation. Successful exploitation can expose stored secrets, enable forged administrative sessions that may persist after patching, and create downstream risk for managed network gear, door-access systems, and surveillance cameras connected through the platform. Ubiquiti said fixes were released in patched UniFi OS Server versions, including protections such as URI normalization, stricter package-name validation, removal of shell-based backend behavior, and reduced passwordless sudo permissions. Defenders are being urged to patch immediately, rotate credentials and secrets, review systems for signs of prior compromise, and limit or remove public exposure of UniFi management interfaces.
Jun 29, 2026
Ubiquiti released **Security Advisory Bulletin 064** to fix five vulnerabilities in **UniFi OS**, including three **unauthenticated remote code execution** flaws tracked as `CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`, each described by community reporting as **CVSS 10.0** issues affecting a broad range of **UDM, UCG, and UNVR** devices. The advisory also addressed `CVE-2026-33000`, a **CVSS 9.1** command injection vulnerability in **UniFi OS Server** that can let an attacker with administrative privileges and network access execute arbitrary operating system commands and potentially gain **root-level control** over managed infrastructure. The command injection bug was reported through **HackerOne** by researcher **V3rlust**, and Ubiquiti said `UniFi OS Server 5.0.8` and later contain the fix, while `5.0.6` and earlier are confirmed vulnerable. Public reporting noted that roughly **87,196 exposed UniFi Network Application hosts** were visible from the internet, raising concern that the unauthenticated RCE flaws could be chained with the command injection issue to compromise internet-facing deployments; administrators were urged to update firmware immediately, restrict management-plane exposure, and verify patch status across deployed systems.
Jul 10, 2026
Ubiquiti released Security Advisory Bulletin 065 to address five vulnerabilities in **UniFi OS**, including critical path traversal (`CVE-2026-47368`), privilege escalation (`CVE-2026-47369`), and command injection (`CVE-2026-47370`) flaws that affect a wide range of consoles, gateways, servers, NVRs, NAS devices, Dream Machines, Cloud Keys, and Express products. The advisory says a network-adjacent attacker could abuse the bugs to read arbitrary files, escalate privileges, execute commands, and in some cases make unauthorized configuration changes through `CVE-2026-48610`, with several issues rated as high as **CVSS 9.9**. Ubiquiti warned that the vulnerabilities can be chained, allowing attackers to remove privilege requirements and potentially reach full device compromise, echoing broader concern over repeated severe UniFi OS weaknesses. Firmware updates were issued with fixes in **UniFi OS 5.1.15** for most affected families, **5.1.16** for **UNAS** devices, and **4.0.15** for **Express** appliances; security reporting around the bulletin also urged organizations to patch all listed CVEs together and treat previously exposed, unpatched management interfaces as potentially compromised.
Jul 12, 2026