Loading story…
Attackers are exploiting critical UniFi OS Server vulnerabilities to deploy an IoT botnet, while a separate investigation uncovered a stealth implant on a UniFi Dream Machine Pro. Ubiquiti advisory SAB-064 covers three independently rated CVSS 10.0 flaws, including CVE-2026-34910; Ubiquiti disclosed them in May 2026, and CISA added them to its Known Exploited Vulnerabilities Catalog in June. PwnDefend captured an attack chaining authentication-gateway bypass, path traversal, and package-update command injection to achieve unauthenticated remote code execution. The attacker downloaded the zok multi-architecture loader to install azsxd v2.0, a Mirai/Gafgyt-derived bot that deleted its executable while continuing to run. Static analysis did not recover its live command-and-control endpoint.
During an authorized penetration test, OffSeq found an exploitable authentication bypass, rogue super-administrator accounts, and evidence of an earlier compromise involving GHOSTWORKER. The implant persisted through a root cron job, masqueraded as a kernel worker, altered its ELF header to hinder analysis, and used Google's DNS-over-HTTPS service for command-and-control. Audit records linked installation and subsequent administrator access to the same external IP address, but investigators did not establish the initial intrusion method or attribute the operation to a named actor. Defenders should upgrade affected UniFi OS Server installations to 5.0.8 or later, restrict management exposure, and investigate suspicious administrators, cron entries, payload downloads, and processes running deleted executables. Confirmed compromised devices should be rebuilt from clean firmware and their credentials and secrets rotated.
See which actors are running it and whether you're in range.
12 events from the most recent confirmed update back to the earliest known activity.
The supports_unifi_system super-administrator account was created at 19:56:12 UTC, followed six seconds later by a login from 185.44.78.8. The same external address appeared in evidence associated with GHOSTWORKER installation.
The GHOSTWORKER executable at /bin/unifi_updater and its root reboot cron entry were written in the same minute on the compromised gateway. The cron entry was written 61 seconds after the last administrator-panel action associated with external address 185.44.78.8.
CISA added CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 to its Known Exploited Vulnerabilities Catalog, confirming observed exploitation in the wild.
Controller records on the compromised UniFi Dream Machine Pro showed creation of the support-lookalike super-administrator account unifi_support. Investigators later concluded that the rogue accounts had been added outside the normal account-creation flow.
Ubiquiti published SAB-064 covering CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, each rated CVSS 10.0. The vulnerabilities can be chained to obtain unauthenticated remote root-level access to affected UniFi systems.
OffSeq's analysis found that GHOSTWORKER falsified its ELF byte-order flag, masqueraded as kernel-worker processes, and used Google's DNS-over-HTTPS resolver for command-and-control, with functionality consistent with credential collection and follow-on payload retrieval. Investigators assessed a single operator as likely but did not establish the initial intrusion method or attribute the operation to a named actor or Linfosys BV.
An outside-in penetration test of a client's internet-facing UniFi Dream Machine Pro exposed seven local user records and demonstrated unauthorized administrator-level changes through an authentication bypass. Investigators also discovered the rogue super-administrator accounts and the unpackaged, root-owned GHOSTWORKER executable.
PwnDefend analyzed an azsxd v2.0 sample as a Mirai/Gafgyt-derived implant and supplied Suricata, YARA, and Microsoft Sentinel detections for the exploit and payload activity. Static analysis did not recover the implant's live command-and-control endpoint.
PwnDefend documented an exploitation request from 176.65.148.183 that combined authentication bypass, traversal, and package-update command injection to retrieve the zok loader from 185.228.26.16. The loader deployed architecture-specific azsxd implants and deleted their executable files while leaving the processes running.
Public proof-of-concept and detection tooling reportedly appeared within days of the advisory, preceding opportunistic mass exploitation of exposed UniFi systems.
Bishop Fox demonstrated the complete exploit chain against UniFi OS Server 5.0.6, showing how the vulnerabilities could be combined to compromise an affected installation.
Ubiquiti addressed the vulnerabilities in UniFi OS Server 5.0.8, including unifi-core 5.0.153. UniFi OS Server versions 5.0.6 and earlier were identified as affected, with product-specific applicability detailed in the vendor advisory.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ubiquiti released security updates for **UniFi OS** to fix five vulnerabilities affecting widely deployed products including **UniFi Cloud Gateway, UniFi Dream Machine, UNVR, NAS devices, consoles, and UniFi OS Server**. Three flaws—`CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`—were rated **CVSS 10.0** and could be exploited by remote, unauthenticated attackers to change system settings, read sensitive files through path traversal, or trigger command injection that could lead to remote code execution. Two additional issues, `CVE-2026-33000` and `CVE-2026-34911`, could also enable command injection, path traversal, privilege escalation, persistence, and data theft under certain conditions. The vulnerabilities were reported through **HackerOne**, and Ubiquiti said they can be exploited with low complexity, although it did not say whether they had been abused before patches were issued. Government and national CERT advisories, including Canada’s Cyber Centre and Germany’s dCERT, directed administrators to review Ubiquiti bulletin 064 and apply updated firmware and software versions immediately. The risk is amplified by the large number of Internet-exposed UniFi OS systems—reportedly close to **100,000**—because these appliances often sit at the network edge and can provide attackers with a path into internal environments if management interfaces are publicly reachable.
Jun 29, 2026
Multiple critical vulnerabilities in **Ubiquiti UniFi OS** can be chained to give an unauthenticated attacker **remote code execution as root** on exposed devices. Fortinet reported active in-the-wild exploitation of an exploit chain involving `CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`, combining authentication bypass, path traversal, access to protected resources, and arbitrary command execution. Researchers have publicly demonstrated the chain, raising the risk for organizations that use UniFi OS to manage gateways, network controllers, video surveillance, and access control systems. `CVE-2026-34909` is described as a **CVSS 10.0** path traversal flaw that can expose sensitive files and enable account compromise, while `CVE-2026-34910` is a **CVSS 10.0** command injection bug affecting a wide range of UniFi hardware and the software-only **UniFi OS Server**. Ubiquiti addressed the issues in **Security Advisory Bulletin 064** with firmware updates across product families, including **UniFi OS 5.1.12** for many devices and other fixed releases for NAS, UDM Beast, and UniFi OS Server platforms. Defenders are being urged to patch immediately, limit management interfaces to trusted networks, review internet-exposed systems for compromise, and perform integrity checks because persistence may remain after remediation.
Aug 15, 2026
Researchers at **Bishop Fox** confirmed that multiple flaws in **Ubiquiti UniFi OS Server** can be chained into **unauthenticated remote code execution** that yields full **root** access on exposed systems. The attack combines an authentication bypass and path traversal in the Nginx/`unifi-core` request flow—tracked as `CVE-2026-34908` and `CVE-2026-34909`—with a command injection bug in the `package-update` service, `CVE-2026-34910`, and can be triggered through a reachable web request against internet-facing management interfaces. Researchers said the chain was validated end-to-end and can also leverage overly permissive sudo rights to complete privilege escalation. Successful exploitation can expose stored secrets, enable forged administrative sessions that may persist after patching, and create downstream risk for managed network gear, door-access systems, and surveillance cameras connected through the platform. Ubiquiti said fixes were released in patched UniFi OS Server versions, including protections such as URI normalization, stricter package-name validation, removal of shell-based backend behavior, and reduced passwordless sudo permissions. Defenders are being urged to patch immediately, rotate credentials and secrets, review systems for signs of prior compromise, and limit or remove public exposure of UniFi management interfaces.
Jun 29, 2026