Improper access control in Ubiquiti UniFi OS (CVE-2026-34908) — network-adjacent unauthorized changes; one of three added the same day
Ubiquiti UniFi OS, widely used networking software, contains an improper access control flaw (CWE-284). An attacker with network access can make unauthorized changes to the system. On June 23, 2026, CISA added three UniFi OS flaws at once (this one, a path traversal, and an input-validation issue), all due three days later, June 26. Official NVD score: CVSS 10.0 (CRITICAL).
Key facts
- CVE IDCVE-2026-34908
- CVSS base score10 CRITICAL
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Affected (vendor / product)Ubiquiti UniFi OS
- CWECWE-284
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-06-26 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Improper access control (CWE-284) in Ubiquiti UniFi OS — network-adjacent attacker makes unauthorized changes
- Official NVD score: CVSS 10.0 (CRITICAL)
- On June 23, 2026, CISA added three UniFi OS flaws at once (this, CVE-2026-34909, CVE-2026-34910); deadline June 26 (3 days)
- The three assemble a privilege-widening chain: access-control break → path traversal → command injection
- Widely deployed networking gear — a scale threat where one technique works across many environments
UniFi is Ubiquiti's product line — Wi-Fi access points, switches, security cameras, gateways — unified under one management console, widely deployed from small businesses to homes. UniFi OS is its foundation. This flaw lies in that OS's access control — the boundary of who may do what — being improper, so someone with network access can make changes they should not be allowed to.
What stands out is that CISA listed three UniFi OS flaws on the same day.
This one (breaking access control), CVE-2026-34909 (path traversal — reaching files that should be off-limits), and CVE-2026-34910 (input validation — command injection) are problems individually, but as a combination of types they assemble the classic ingredients of a chain in which an attacker gradually widens privilege: open the door (access control) → look inside (path traversal) → run arbitrary commands (command injection). Three simultaneous KEV additions signal this product line is actually being targeted.
Networking gear is a chokepoint that all traffic passes through, yet updates are deferred and monitoring is thin. A flaw in widely deployed gear like UniFi carries the scale advantage that the same technique works across many environments. The baseline response is prompt updating per Ubiquiti's guidance; also review whether the management console is externally exposed.
Why it matters
A flaw in widely deployed networking gear becomes a "scale threat," where one technique works across many environments. With three same-day flaws (access control, path traversal, input validation) assembling a chain, UniFi operators should update promptly and review external exposure of the console. Also a lesson in not deferring updates on networking gear.
FAQ
What is UniFi OS?
Why were three added at once?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).