Article
Why CVSS Scores Are Lying to Your Security Team (And What to Use Instead)
CVSS scores show worst-case severity, not attacker behavior. See how EPSS, the CISA KEV catalog and SSVC help you decide which flaws to fix…
Read more
Exploited vulnerability
UniFi OS Improper Access Control (CVE-2026-34908)
A critical improper access control flaw in UniFi OS, the operating system of Ubiquiti gateways, recorders, storage units and UniFi OS Server.
- On CISA KEV
- CVE ID
- CVE-2026-34908
- CVSS
- 10.0 Critical (CVSS v3.1, HackerOne as CNA; NVD shows the CNA score); no CVSS 4.0 score in the record or NVD
- CISA KEV
- Listed
- Affected product
- UniFi OS Server and UniFi OS device lines (Dream Machine, Dream Router, Cloud Gateway, Cloud Key, NVR and NAS models)
- Exploited
- Yes
- Published
- 21 May 2026 (Ubiquiti Security Advisory Bulletin 064); CVE record 22 May 2026
In short
CVE-2026-34908 is a critical improper access control flaw in UniFi OS, the operating system of Ubiquiti gateways, recorders, storage units and UniFi OS Server. Ubiquiti says an attacker with network access can make unauthorized changes to the system. The CVE has a CVSS 3.1 score of 10.0, and CISA added it to its KEV catalog on 23 June 2026.
- CVECVE-2026-34908
- ProductUbiquiti UniFi OS Server and UniFi OS device lines (Dream Machine, Dream Router, Cloud Gateway, Cloud Key, NVR and NAS models)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listed
What it allows
Ubiquiti's Security Advisory Bulletin 064 says a malicious actor with network access could exploit an improper access control flaw in UniFi OS devices to make unauthorized changes to the system. The CVE record repeats that text. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, so the flaw is reachable over the network, needs no privileges and changes scope.
Access Control, Not a Path Traversal
Ubiquiti's wording and the CWE in the CVE record (CWE-284, improper access control) say access control. The path traversal in the same bulletin is CVE-2026-34909, which Ubiquiti describes as file access on the underlying system.
The bulletin and the CVE record give no more detail than that one line, so we do not describe how the flaw works.
A Public Detector Exists
A GitHub repository under the Bishop Fox name, created on 5 June 2026, holds a script for UniFi OS Server 5.0.6 and earlier. Its authors say it sends only GET requests, runs no command and changes no state. We have not reviewed the code, so check it yourself before using it, and test only servers you are authorised to test.
Exploitation Signals for CVE-2026-34908
These are the public signals we checked on 4 November 2026.
Exploit signals
- CISA KEVYesAdded 23 June 2026 with a due date of 26 June; ransomware use is listed as unknown4 Nov
- CISA SSVC in the CVE recordYesExploitation active, automatable yes, technical impact total4 Nov
- Detection scriptYesOne GitHub repository created 5 June 2026 that its authors describe as a safe detector4 Nov
- Brandefense BlackholeYesEight saved posts from 6 June to 24 September 2026, mostly CVE feed bots and news reposts4 Nov
Verdict In CISA KEV since 23 June 2026
The CVE record shows the SSVC entry for both CVE-2026-34908 and CVE-2026-34910, and CISA added both to KEV on the same day. We did not run or link the detector. See also how network segmentation limits who can reach a management interface.
Who is affected
Ubiquiti's bulletin lists the same affected builds and fixed versions for CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910 in its UniFi OS product lines. The table below follows the bulletin, one row per group of products.
The bulletin lists Express, version 4.0.13 and earlier, with a fix in 4.0.14, only under CVE-2026-34909, the path traversal. The CISA KEV entry names the product as UniFi OS. The CVE record lists UniFi OS Server below 5.0.8 and the device models, with fixed versions that match the table.
Because the fixed version is the same under each entry, one update to that version meets the requirement of all three CVEs. Our vulnerability management guide covers how to plan and check a rollout across many devices. The sibling page on CVE-2026-34910 lists the same table.
Timeline
- 21 May 2026
Ubiquiti publishes Security Advisory Bulletin 064, crediting Duc Anh Nguyen (@heckintosh_) for CVE-2026-34908.
- 22 May 2026
Ubiquiti updates the bulletin to version 1.1 and the CVE record and NVD entry are published.
- 5 June 2026
A GitHub repository with a detection script for CVE-2026-34908 is created.
- 23 June 2026
CISA adds CVE-2026-34908 and CVE-2026-34910 to its KEV catalog, with a due date of 26 June 2026.
What to do
-
Update UniFi OS to the Fixed Version
Install the version in the table for each device: 5.1.12 for most gateways, routers, recorders and Cloud Keys, 5.1.10 for the NAS line, 5.1.11 for UDM-Beast and 5.0.8 for UniFi OS Server.
-
Confirm the Version After the Update
Check the UniFi OS version on every device and on UniFi OS Server, not only the Network application version. Ubiquiti's fixed versions refer to UniFi OS.
-
Limit Who Can Reach the Management Interface
We recommend allowing the interface only from a management network or VPN. Ubiquiti lists updating as the mitigation, so this is an added layer from us.
-
Check Devices That Were Exposed
We recommend reviewing admin accounts, management logins and configuration changes on any device whose management interface was reachable from the internet before the update. This is our general advice, since the bulletin describes the flaw only as unauthorized changes to the system.
Questions
Is CVE-2026-34908 a path traversal?
Ubiquiti and the CVE record call it an improper access control flaw (CWE-284). The path traversal in the same bulletin is CVE-2026-34909.
Is CVE-2026-34908 exploited?
CISA lists it in KEV since 23 June 2026, and the CVE record carries a CISA SSVC entry with exploitation marked active.
Can I test whether my UniFi OS Server is vulnerable?
A public detector for UniFi OS Server 5.0.6 and earlier exists, and its authors describe it as safe. We have not reviewed it, so read the code yourself and test only servers you are authorised to test.
What fixes it?
Ubiquiti's fix is a UniFi OS update: 5.0.8 for UniFi OS Server, 5.1.10 for the NAS line, 5.1.11 for UDM-Beast and 5.1.12 for the other listed devices.
Sources
- Security Advisory Bulletin 064 Ubiquiti Community
- CVE-2026-34908 Record CVE Program
- CVE-2026-34908 NVD
- Known Exploited Vulnerabilities Catalog entry for CVE-2026-34908 CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 151 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.