CVE-2026-34908
Ubiquiti UniFi OS Improper Access Control Vulnerability
Description
CVE-2026-34908 is a CRITICAL improper access control vulnerability in Ubiquiti UniFi OS, the operating system that powers UniFi gateways, dream machines, and network video recorders. Carrying the maximum CVSS 3.1 score of 10.0, the flaw lets a malicious actor with access to the network make unauthorized changes to the affected system without any authentication. Because UniFi OS devices sit at the edge of the network and control routing, firewalling, and video surveillance, exploitation of this improper access control vulnerability can hand an attacker full control over critical network infrastructure. CVE-2026-34908 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2026-06-26, and a related in-the-wild exploitation report underscores that this UniFi OS vulnerability demands immediate patching.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ui | unifi os server | < 5.0.8 |
| ui | unifi cloud gateway industrial firmware | < 5.1.12 |
| ui | unifi dream machine firmware | < 5.1.12 |
| ui | unifi dream machine pro firmware | < 5.1.12 |
| ui | unifi dream machine special edition firmware | < 5.1.12 |
| ui | unifi dream machine pro max firmware | < 5.1.12 |
| ui | enterprise fortress gateway firmware | < 5.1.12 |
| ui | unifi dream wall firmware | < 5.1.12 |
| ui | unifi dream router firmware | < 5.1.12 |
| ui | unifi dream router 7 firmware | < 5.1.12 |
| ui | unifi express 7 firmware | < 5.1.12 |
| ui | unifi network video recorder firmware | < 5.1.12 |
| ui | unifi network video recorder pro firmware | < 5.1.12 |
| ui | unifi network video recorder instant firmware | < 5.1.12 |
| ui | enterprise network video recorder firmware | < 5.1.12 |
| ui | unifi cloud gateway ultra firmware | < 5.1.12 |
| ui | unifi cloud gateway max firmware | < 5.1.12 |
| ui | unifi cloud gateway fiber firmware | < 5.1.12 |
| ui | unifi dream router 5g max firmware | < 5.1.12 |
| ui | enterprise network video recorder core firmware | < 5.1.12 |
References
- https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908(US Government Resource)
- https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/(Exploit, Third Party Advisory)
Weakness Type
CWE-284: Improper Access Control
CVE-2026-34908 stems from CWE-284, where UniFi OS fails to properly restrict access to a resource from an unauthorized actor. Because the affected UniFi OS devices do not correctly enforce who may perform sensitive operations, an unauthenticated attacker on the network can bypass the intended authorization boundary and make unauthorized changes to the system — a textbook access control failure that OWASP ranks as its number-one vulnerability category.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2026-34908 carries the maximum CVSS 3.1 score of 10.0 (CRITICAL) and is remotely exploitable over the network without physical access (Attack Vector NETWORK), easy to exploit with no special conditions (Attack Complexity LOW), requires no authentication (Privileges Required NONE), and needs no user interaction (User Interaction NONE). A successful exploit yields HIGH impact to confidentiality, integrity, and availability: an attacker can read sensitive configuration and data, alter device settings and firewall or routing rules, and disrupt the availability of the network and video-recording services. Critically, the scope is CHANGED, meaning the compromise can extend beyond the vulnerable UniFi OS component to affect other resources on the network it governs. With confirmed active exploitation via the KEV listing and the strategic position of UniFi OS devices at the network perimeter, organizations running affected versions should treat this improper access control vulnerability as an emergency.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-34908 by adding it to the Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 2026-06-26. A third-party analysis of in-the-wild exploitation of UniFi OS devices — including their recruitment into a Mirai-style botnet — is publicly available at pwndefend.com, indicating that attack techniques against this device class are already documented and circulating. The EPSS score of 0.02452 places CVE-2026-34908 in the 82.4th percentile, meaning exploitation is more likely than for the majority of CVEs, and the KEV ransomware status is currently listed as Unknown. Given confirmed exploitation and the maximum CVSS 10.0 rating, organizations should assume attacks are ongoing and patch immediately.
Remediation
- Follow the CISA KEV required action. Apply mitigations in accordance with Ubiquiti's instructions, ensuring compliance with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and CISA's "Forensics Triage Requirements." For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable; the KEV remediation deadline was 2026-06-26.
- Upgrade to a fixed firmware version. Update UniFi OS Server to version 5.0.8 or later, and update UniFi gateway, dream machine, cloud gateway, express, and network video recorder firmware (including the UniFi Dream Machine, Dream Machine Pro/SE/Pro Max, Dream Router, Cloud Gateway Ultra/Max/Fiber, and Enterprise Fortress Gateway) to version 5.1.12 or later. Consult the vendor advisory at community.ui.com.
- Restrict and segment network access. Until every device is patched, limit management access to UniFi OS to trusted administrative networks only, block exposure of management interfaces to the internet, and place these devices behind strict network segmentation so an unauthenticated actor cannot reach the vulnerable endpoints.
- Hunt for signs of compromise. Review UniFi OS logs and audit trails for unexpected configuration changes, new or modified accounts, altered firewall/routing rules, and unfamiliar administrative activity, given the confirmed in-the-wild exploitation.
- Harden access control long-term. Enforce the principle of least privilege, deny access by default and require explicit grants, validate authorization on every request server-side, and centralize access control logic so authorization is consistently enforced across all UniFi OS management functions.
Technical Details
CVE-2026-34908 is an improper access control vulnerability (CWE-284) in Ubiquiti UniFi OS that arises because the software does not properly restrict access to sensitive operations from an unauthorized actor. Access control determines who can access which resources and what actions they may perform; when that enforcement fails, an attacker who can reach the device over the network is able to invoke privileged functionality and make unauthorized changes to the system. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H shows the attack is network-borne, low-complexity, requires no privileges, and needs no user interaction, which combined with a CHANGED scope and HIGH impact across confidentiality, integrity, and availability produces the maximum CVSS score of 10.0. This class of failure is among the most severe in network appliances precisely because a single missing authorization check exposes the full administrative capability of an edge device.
Frequently Asked Questions
Is CVE-2026-34908 being actively exploited?
Yes. CVE-2026-34908 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, with a remediation deadline of 2026-06-26. A public third-party report documents in-the-wild exploitation of UniFi OS devices, and the EPSS score of 0.02452 (82.4th percentile) indicates elevated exploitation likelihood. Ransomware involvement is currently listed as Unknown.
What products are affected by CVE-2026-34908?
The vulnerability affects Ubiquiti UniFi OS across a wide range of devices: UniFi OS Server prior to 5.0.8, and firmware prior to 5.1.12 for the UniFi Dream Machine, Dream Machine Pro/SE/Pro Max, Dream Router, Dream Router 7, Dream Router 5G Max, Dream Wall, Express 7, Cloud Gateway Industrial/Ultra/Max/Fiber, Enterprise Fortress Gateway, and the UniFi and Enterprise Network Video Recorder lines. Administrators should verify the firmware version on every UniFi OS device.
How do I fix CVE-2026-34908?
Upgrade UniFi OS Server to 5.0.8 or later and affected device firmware to 5.1.12 or later per the Ubiquiti vendor advisory, following CISA's BOD 26-04 patching guidance. While patching, restrict management access to trusted networks, keep management interfaces off the internet, and review logs for unauthorized changes as described in the Remediation section.
How severe is CVE-2026-34908?
CVE-2026-34908 is rated CRITICAL with the maximum CVSS 3.1 score of 10.0. It permits an unauthenticated network attacker to make unauthorized changes to the system with no user interaction, achieving HIGH impact to confidentiality, integrity, and availability with a CHANGED scope. Its inclusion in the KEV catalog and 82.4th-percentile EPSS score make it a top-priority vulnerability for immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.