Improper access control in Ubiquiti UniFi OS (CVE-2026-34908) — network-adjacent unauthorized changes; one of three added the same day
Ubiquiti UniFi OS, widely used networking software, contains an improper access control flaw (CWE-284). An attacker with network access can make unauthorized changes to the system. On June 23, 2026, CISA added three UniFi OS flaws at once (this one, a path traversal, and an input-validation issue), all due three days later, June 26. Official NVD score: CVSS 10.0 (CRITICAL).
Key facts
- CVE IDCVE-2026-34908
- CVSS base score10 CRITICAL
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Affected (vendor / product)Ubiquiti UniFi OS
- CWECWE-284
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-06-26 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Improper access control (CWE-284) in Ubiquiti UniFi OS — network-adjacent attacker makes unauthorized changes
- Official NVD score: CVSS 10.0 (CRITICAL)
- On June 23, 2026, CISA added three UniFi OS flaws at once (this, CVE-2026-34909, CVE-2026-34910); deadline June 26 (3 days)
- The three assemble a privilege-widening chain: access-control break → path traversal → command injection
- Widely deployed networking gear — a scale threat where one technique works across many environments
- The three entries added on one day map to opening the entrance, looking inside, and running arbitrary commands.
1The UniFi device family
UniFi is Ubiquiti's product line — Wi-Fi access points, switches, security cameras, gateways — unified under one management console, widely deployed from small businesses to homes. UniFi OS is its foundation. This flaw lies in that OS's access control — the boundary of who may do what — being improper, so someone with network access can make changes they should not be allowed to.
2Three flaws entering KEV the same day
What stands out is that CISA listed three UniFi OS flaws on the same day.
This one (breaking access control), CVE-2026-34909 (path traversal — reaching files that should be off-limits), and CVE-2026-34910 (input validation — command injection) are problems individually, but as a combination of types they assemble the classic ingredients of a chain in which an attacker gradually widens privilege: open the door (access control) → look inside (path traversal) → run arbitrary commands (command injection). Three simultaneous KEV additions signal this product line is actually being targeted.
3Devices whose updates get postponed
Networking gear is a chokepoint that all traffic passes through, yet updates are deferred and monitoring is thin. A flaw in widely deployed gear like UniFi carries the scale advantage that the same technique works across many environments. The baseline response is prompt updating per Ubiquiti's guidance; also review whether the management console is externally exposed.
4Three entries lined up as stages
Setting the three entries added to KEV on one day in the order an attacker would widen privilege shows the full set of material present.
- 1Open the entrance (CVE-2026-34908, this record)Break access control to reach a state where unauthorised changes are possible
- 2Look inside (CVE-2026-34909)Use path traversal to reach configuration and credential files
- 3Land the decisive blow (CVE-2026-34910)Use command injection from missing input validation to run arbitrary commands
The CWEs differ, yet the target — a widely deployed network OS — and the direction, widening privilege, are the same. UniFi bundles Wi-Fi access points, switches, cameras and gateways into one management interface and is widely deployed from small businesses to homes. A vulnerability in widely deployed equipment carries the advantage of scale for an attacker: one technique works across many environments.
Why it matters
A flaw in widely deployed networking gear becomes a "scale threat," where one technique works across many environments. With three same-day flaws (access control, path traversal, input validation) assembling a chain, UniFi operators should update promptly and review external exposure of the console. Also a lesson in not deferring updates on networking gear.
FAQ
What is UniFi OS?
Why were three added at once?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).