CVE-2026-34909
Ubiquiti UniFi OS Path Traversal Vulnerability
Description
CVE-2026-34909 is a CRITICAL path traversal vulnerability in Ubiquiti UniFi OS, carrying the maximum CVSS 3.1 score of 10.0. The flaw lets a malicious actor with network access to a UniFi OS device supply crafted path sequences that escape the intended directory and read files on the underlying system, which can in turn be manipulated to gain access to an underlying account. Because UniFi OS runs on gateways, dream machines, and network video recorders that sit at the edge of the network, exploitation of this path traversal vulnerability requires no authentication and can lead to full compromise of the affected appliance. CVE-2026-34909 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2026-06-26, and public exploitation analysis is already circulating, making prompt patching of every affected UniFi OS device essential.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ui | unifi os server | < 5.0.8 |
| ui | unifi cloud gateway industrial firmware | < 5.1.12 |
| ui | unifi dream machine firmware | < 5.1.12 |
| ui | unifi dream machine pro firmware | < 5.1.12 |
| ui | unifi dream machine special edition firmware | < 5.1.12 |
| ui | unifi dream machine pro max firmware | < 5.1.12 |
| ui | enterprise fortress gateway firmware | < 5.1.12 |
| ui | unifi dream wall firmware | < 5.1.12 |
| ui | unifi dream router firmware | < 5.1.12 |
| ui | unifi dream router 7 firmware | < 5.1.12 |
| ui | unifi express 7 firmware | < 5.1.12 |
| ui | unifi network video recorder firmware | < 5.1.12 |
| ui | unifi network video recorder pro firmware | < 5.1.12 |
| ui | unifi network video recorder instant firmware | < 5.1.12 |
| ui | enterprise network video recorder firmware | < 5.1.12 |
| ui | unifi cloud gateway ultra firmware | < 5.1.12 |
| ui | unifi cloud gateway max firmware | < 5.1.12 |
| ui | unifi cloud gateway fiber firmware | < 5.1.12 |
| ui | unifi dream router 5g max firmware | < 5.1.12 |
| ui | enterprise network video recorder core firmware | < 5.1.12 |
References
- https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34909(US Government Resource)
- https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/(Exploit, Third Party Advisory)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-34909 stems from CWE-22, where UniFi OS uses external input to construct a file path but fails to neutralize special elements such as "../" that let the path resolve outside the intended restricted directory. By manipulating these path references, an unauthenticated attacker can break out of the intended directory structure and read arbitrary files on the underlying UniFi OS system — files that can then be leveraged to reach an underlying account.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2026-34909 carries the maximum CVSS 3.1 score of 10.0 (CRITICAL) and is remotely exploitable without physical access (Attack Vector NETWORK), easy to exploit with no special conditions (Attack Complexity LOW), requires no authentication (Privileges Required NONE), and needs no user interaction. A successful exploit yields HIGH impact to confidentiality, integrity, and availability: the attacker can read sensitive files from the underlying UniFi OS system, manipulate those files to access an underlying account, and from there tamper with the device or disrupt its availability. Critically, the scope is Changed, meaning the vulnerability can affect resources beyond the vulnerable component — a compromised UniFi OS gateway or recorder can serve as a foothold into the wider network it protects. With confirmed active exploitation via the KEV listing and an EPSS score in the 80.9th percentile, organizations running affected UniFi OS devices should treat this path traversal vulnerability as an urgent priority.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-34909 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 2026-06-26. Public exploitation analysis is available via a third-party advisory documenting in-the-wild UniFi OS exploitation and Mirai-style botnet building at pwndefend.com, underscoring that attackers are already weaponizing this vulnerability class against exposed devices. The EPSS score of 0.02269 places CVE-2026-34909 in the 80.9th percentile, indicating exploitation is more likely than for the majority of CVEs; the KEV ransomware status is currently listed as Unknown. Given confirmed exploitation and public analysis, organizations should assume attacks are ongoing and patch every affected UniFi OS device immediately.
Remediation
- Apply the vendor mitigations per CISA's KEV required action. Apply mitigations in accordance with Ubiquiti's instructions, ensuring compliance with CISA's BOD 26-04 guidance on prioritizing security updates based on risk and CISA's Forensics Triage Requirements; follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Consult the vendor advisory at community.ui.com.
- Upgrade to a fixed firmware/software build. Update UniFi OS Server to 5.0.8 or later, and update affected appliance firmware — including UniFi Dream Machine, Dream Machine Pro/Pro Max/Special Edition, Dream Router (and 7 / 5G Max), Dream Wall, Express 7, Cloud Gateway (Ultra/Max/Fiber/Industrial), Enterprise Fortress Gateway, and the UniFi/Enterprise Network Video Recorder line — to 5.1.12 or later.
- Restrict network access to management interfaces. Until every device is patched, place UniFi OS management interfaces behind network segmentation and firewall rules so they are not reachable from the internet or untrusted VLANs, since the attack requires only network access.
- Hunt for prior exploitation. Review device and access logs for anomalous file-access requests containing traversal sequences (e.g. "../") and for unexpected account activity, given confirmed in-the-wild exploitation of UniFi OS.
- Harden against path traversal long-term. Where configurable, enforce strict input validation using an allowlist of permitted filenames or path components rather than blocklisting malicious sequences, and rely on canonical path resolution that verifies the resolved absolute path falls within the intended directory before any file operation.
Technical Details
CVE-2026-34909 is a path traversal (directory traversal) vulnerability in Ubiquiti UniFi OS that is triggered when the device constructs a file path from attacker-supplied input without properly neutralizing special elements such as ".." and "/". Because these sequences are not sanitized, an attacker on the network can force the pathname to resolve to a location outside the restricted parent directory, reading files anywhere on the underlying file system that the UniFi OS process can access; those files can then be manipulated to reach an underlying account. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H shows the attack is network-borne, low-complexity, requires no privileges and no user interaction, and — with a Changed scope — produces full HIGH impact across confidentiality, integrity, and availability, which is why it reaches the maximum score of 10.0. This class of flaw (CWE-22) is especially dangerous on network appliances because a single unauthenticated request can expose credentials and configuration that unlock deeper access.
Frequently Asked Questions
Is CVE-2026-34909 being actively exploited?
Yes. CVE-2026-34909 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, with a remediation deadline of 2026-06-26. Public exploitation analysis documenting in-the-wild UniFi OS attacks is available, and the EPSS score of 0.02269 (80.9th percentile) indicates above-average exploitation likelihood. Ransomware involvement is currently listed as Unknown.
What products are affected by CVE-2026-34909?
The vulnerability affects Ubiquiti UniFi OS Server (versions before 5.0.8) and the firmware of a wide range of UniFi OS appliances before 5.1.12, including the UniFi Dream Machine, Dream Machine Pro/Pro Max/Special Edition, Dream Router (and Dream Router 7 / 5G Max), Dream Wall, Express 7, the Cloud Gateway family (Ultra, Max, Fiber, Industrial), the Enterprise Fortress Gateway, and the UniFi and Enterprise Network Video Recorder line. Administrators should verify the version of every UniFi OS device and prioritize updating.
How do I fix CVE-2026-34909?
Apply Ubiquiti's mitigations per the vendor advisory and CISA's KEV required action, upgrading UniFi OS Server to 5.0.8 or later and affected appliance firmware to 5.1.12 or later. While patching, restrict network access to management interfaces, review logs for traversal-based file access, and discontinue use of any device for which mitigations are unavailable, as described in the Remediation section.
How severe is CVE-2026-34909?
CVE-2026-34909 is rated CRITICAL with the maximum CVSS 3.1 score of 10.0. It permits unauthenticated, remote exploitation with no user interaction and achieves HIGH impact to confidentiality, integrity, and availability with a Changed scope. Its inclusion in the KEV catalog and 80.9th-percentile EPSS score make it a top-priority vulnerability for immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.