Path traversal in Ubiquiti UniFi OS (CVE-2026-34909) — reaching off-limits files as a foothold to account takeover; one of three added the same day
A path-traversal flaw (CWE-22) in Ubiquiti UniFi OS. A network-adjacent attacker can reach files on the underlying system that should be off-limits and manipulate them to access an internal account. On June 23, 2026, CISA added three UniFi OS flaws at once; remediation due three days later. Official NVD score: CVSS 10.0 (CRITICAL).
Key facts
- CVE IDCVE-2026-34909
- CVSS base score10 CRITICAL
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Affected (vendor / product)Ubiquiti UniFi OS
- CWECWE-22
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-06-26 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Path traversal (CWE-22) in Ubiquiti UniFi OS — reaching off-limits underlying files, a foothold to internal account takeover
- Official NVD score: CVSS 10.0 (CRITICAL)
- On June 23, 2026, CISA added three UniFi OS flaws at once; deadline June 26 (3 days)
- The "look inside" middle of the same-day chain: access-control break → this → command execution
- A networking OS holds configuration/credentials, so file reach can lead directly to device control
Path traversal (directory traversal) means slipping crafted sequences like "../" into a file path to reach files outside the intended, permitted area. Reaching configuration files or credential files provides a foothold toward taking over an internal account. This flaw makes that possible in Ubiquiti UniFi OS, and the KEV record states the reached files, if manipulated, can lead to access to an internal account.
This vulnerability plays the "look inside" role among the three that entered KEV the same day.
Read as a chain — gain a foothold via CVE-2026-34908 (breaking access control), gather privilege-escalation material via this one (path traversal to internal files), then land the decisive blow via CVE-2026-34910 (command execution) — the meaning of three flaws in the same product becoming remediation targets together comes into focus.
The CWEs differ, but the target (widely deployed networking OS) and the direction (widening privilege) align.
A networking device's OS holds a bundle of keys — configuration and credentials. Path traversal into it can lead directly to control of the device. The response is prompt updating per Ubiquiti's guidance, closing all three together.
Why it matters
Path traversal into a networking OS can lead directly to device control by reaching the bundle of keys — configuration and credentials. As the middle of the same-day chain, UniFi operators should update as a set. A case where the meaning of "multiple types found in one product at once" outweighs any single CVSS.
FAQ
What is path traversal?
How do the three relate?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).