Log in Request a demo

Exploited vulnerability

UniFi OS Command Injection (CVE-2026-34910)

A critical command injection in UniFi OS, the operating system of Ubiquiti gateways, recorders, storage units and UniFi OS Server.

  • On CISA KEV
CVE ID
CVE-2026-34910
CVSS
10.0 Critical (CVSS v3.1, HackerOne as CNA; NVD shows the CNA score); no CVSS 4.0 score in the record or NVD
CISA KEV
Listed
Affected product
UniFi OS Server and UniFi OS device lines (Dream Machine, Dream Router, Cloud Gateway, Cloud Key, NVR and NAS models)
Exploited
Yes
Published
21 May 2026 (Ubiquiti Security Advisory Bulletin 064); CVE record 22 May 2026

In short

CVE-2026-34910 is a critical command injection in UniFi OS, the operating system of Ubiquiti gateways, recorders, storage units and UniFi OS Server. Ubiquiti says an attacker with network access can run commands on an affected device. The CVE has a CVSS 3.1 score of 10.0, and CISA added it to its KEV catalog on 23 June 2026.

Profile MapVulnerability
  1. CVECVE-2026-34910
  2. ProductUbiquiti UniFi OS Server and UniFi OS device lines (Dream Machine, Dream Router, Cloud Gateway, Cloud Key, NVR and NAS models)
  3. CISA KEVListedKnown Exploited Vulnerabilities
  4. ExploitedYesin real attacks
  5. Fix Steps5actions listed

What it allows

Ubiquiti's Security Advisory Bulletin 064 says a malicious actor with network access could exploit an improper input validation flaw in UniFi OS devices to run a command injection. The CVE record repeats that text and adds no technical detail. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which means network reachable, low complexity, no privileges, no user action and a changed scope.

UniFi OS is the operating system that runs Ubiquiti's gateways, recorders, network storage units and the self-hosted UniFi OS Server. A command injection lets an attacker place their own commands inside input that the system later hands to a shell. Ubiquiti rates the impact on confidentiality, integrity and availability as high.

Where It Sits in Bulletin 064

Ubiquiti published the bulletin on 21 May 2026 and updated it on 22 May. It lists five CVEs, and three of them are rated CVSS 3.1 10.0: CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910. Ubiquiti scored each one on its own.

The other two entries are CVE-2026-33000, a command injection that needs high privileges (CVSS 3.1 9.1), and CVE-2026-34911, a path traversal for low-privilege users (CVSS 3.1 7.7). Our page on CVE-2026-34908, the UniFi OS access control flaw covers the entry that Ubiquiti describes as unauthorized changes to the system.

How It Differs From CVE-2026-33000

CVE-2026-33000 is the other command injection in the bulletin. The CVE record says it needs high privileges, which is why its CVSS 3.1 vector has PR:H and a score of 9.1. The vector of CVE-2026-34910 has PR:N and a score of 10.0, so the CVE record sets no account requirement for this flaw.

Exploitation Signals for CVE-2026-34910

These are the public signals we checked on 4 November 2026.

Exploit signals
  • CISA KEVYesAdded 23 June 2026 with a due date of 26 June; ransomware use is listed as unknown4 Nov
  • CISA SSVC in the CVE recordYesExploitation active, automatable yes, technical impact total4 Nov
  • Public PoC codeYesTwo GitHub repositories, the first created 9 August 2026; their authors say it is working exploit code4 Nov
  • Brandefense BlackholeYesNine saved posts from 8 June to 24 September 2026, mostly CVE feed bots, news reposts and a PoC repository alert4 Nov
Verdict In CISA KEV since 23 June 2026

The authors of both repositories say their code gives unauthenticated code execution and file read through CVE-2026-34910 together with CVE-2026-34909. We have not verified those claims, and we did not run or link the code. The CISA KEV catalog lists only flaws with evidence of exploitation.

Who is affected

Ubiquiti's bulletin lists the same affected builds and fixed versions for CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910 in its UniFi OS product lines. The table below follows the bulletin, one row per group of products.

The bulletin lists Express, version 4.0.13 and earlier, with a fix in 4.0.14, only under CVE-2026-34909. The CISA KEV entry names the product as UniFi OS. The CVE record lists UniFi OS Server below 5.0.8 and the device models, with fixed versions that match the table.

Because the fixed version is the same under each entry, one update to that version meets the requirement of all three CVEs. Our vulnerability management guide covers how to plan and check a rollout across many devices.

Timeline

  1. 21 May 2026

    Ubiquiti publishes Security Advisory Bulletin 064 with five UniFi OS CVEs.

  2. 22 May 2026

    Ubiquiti updates the bulletin to version 1.1 and the CVE record and NVD entry are published.

  3. 23 June 2026

    CISA adds CVE-2026-34910 and CVE-2026-34908 to its KEV catalog, with a due date of 26 June 2026.

  4. 9 August 2026

    The first of two GitHub repositories claiming proof-of-concept code for CVE-2026-34910 is created.

What to do

  1. Update UniFi OS to the Fixed Version

    Install the version in the table for each device: 5.1.12 for most gateways, routers, recorders and Cloud Keys, 5.1.10 for the NAS line, 5.1.11 for UDM-Beast and 5.0.8 for UniFi OS Server.

  2. Start With Internet-Facing Devices

    Update any device or UniFi OS Server whose management interface can be reached from the internet first. We recommend treating a device that ran an earlier build while exposed as a possible compromise and checking it, as well as updating it.

  3. Review Logs and Settings on Exposed Devices

    We recommend reviewing admin accounts, management logins and configuration changes on any device that ran an earlier build while reachable from the network. This is our general advice, not a vendor list of indicators.

  4. Take the Management Interface Off the Internet

    We recommend limiting the UniFi OS interface to a management network or VPN. Ubiquiti's bulletin lists updating as the mitigation, so access limits are an added layer from us.

  5. Rotate Secrets on Any Device Suspected of Compromise

    We recommend rebuilding the device from a clean image, then changing local admin passwords, API keys and Wi-Fi keys it held. This follows from the code execution Ubiquiti describes.

Questions

Is CVE-2026-34910 being exploited?

CISA lists it in KEV since 23 June 2026, and the CVE record carries a CISA SSVC entry with exploitation marked active.

Is this the same flaw as CVE-2026-33000?

No. Ubiquiti lists CVE-2026-33000 as a separate command injection that needs high privileges, rated CVSS 3.1 9.1. CVE-2026-34910 is rated 10.0 and its vector sets no privilege requirement.

Do I need a separate update for CVE-2026-34908?

The bulletin gives the same fixed version for each product under CVE-2026-34908 and CVE-2026-34910. One update to that version meets both entries.

Which devices are affected?

The bulletin lists UniFi OS Server 5.0.6 and earlier plus gateway, router, Cloud Key, recorder and NAS lines, each with its own earlier-than version. The table on this page lists every group.

Sources

  1. Security Advisory Bulletin 064 Ubiquiti Community
  2. CVE-2026-34910 Record CVE Program
  3. CVE-2026-34910 NVD
  4. Known Exploited Vulnerabilities Catalog entry for CVE-2026-34910 CISA

Last updated 4 November 2026

Browse the threat library

Keep exploring

Knowledge Hub