CVE-2026-34910
Ubiquiti UniFi OS Improper Input Validation Vulnerability
Description
CVE-2026-34910 is a CRITICAL command injection vulnerability, rooted in improper input validation, affecting Ubiquiti UniFi OS devices and carrying the maximum CVSS 3.1 score of 10.0. Because UniFi OS does not properly validate attacker-supplied input, a malicious actor with network access can inject and execute arbitrary operating-system commands on the affected device without any authentication or user interaction. Successful exploitation of CVE-2026-34910 gives an attacker complete control over the device — routers, gateways, and network video recorders that sit at the edge of the network — enabling data theft, traffic interception, and use of the device as a pivot into the internal network. The vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and with an EPSS score of 0.78555 (99.5th percentile) plus a public exploit report describing Mirai botnet exploitation in the wild, CVE-2026-34910 is an urgent, actively exploited threat that demands immediate patching of every UniFi OS device.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ui | unifi os server | < 5.0.8 |
| ui | unifi cloud gateway industrial firmware | < 5.1.12 |
| ui | unifi dream machine firmware | < 5.1.12 |
| ui | unifi dream machine pro firmware | < 5.1.12 |
| ui | unifi dream machine special edition firmware | < 5.1.12 |
| ui | unifi dream machine pro max firmware | < 5.1.12 |
| ui | enterprise fortress gateway firmware | < 5.1.12 |
| ui | unifi dream wall firmware | < 5.1.12 |
| ui | unifi dream router firmware | < 5.1.12 |
| ui | unifi dream router 7 firmware | < 5.1.12 |
| ui | unifi express 7 firmware | < 5.1.12 |
| ui | unifi network video recorder firmware | < 5.1.12 |
| ui | unifi network video recorder pro firmware | < 5.1.12 |
| ui | unifi network video recorder instant firmware | < 5.1.12 |
| ui | enterprise network video recorder firmware | < 5.1.12 |
| ui | unifi cloud gateway ultra firmware | < 5.1.12 |
| ui | unifi cloud gateway max firmware | < 5.1.12 |
| ui | unifi cloud gateway fiber firmware | < 5.1.12 |
| ui | unifi dream router 5g max firmware | < 5.1.12 |
| ui | enterprise network video recorder core firmware | < 5.1.12 |
References
- https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34910(US Government Resource)
- https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/(Exploit, Third Party Advisory)
Weakness Type
CWE-20: Improper Input Validation
CVE-2026-34910 stems from CWE-20, where UniFi OS receives input but fails to verify that it conforms to the expected format, length, type, or character set before processing it. Because the device accepts unvalidated, attacker-controlled data and passes it into a context where it is interpreted as an operating-system command, an unauthenticated network attacker can supply malformed input that alters program behavior and achieves command injection. This improper input validation is the root cause that turns a routine data-handling path into a full remote code execution primitive.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2026-34910 carries the maximum CVSS 3.1 score of 10.0 (CRITICAL) and is remotely exploitable without physical access (Attack Vector NETWORK), easy to exploit with no special conditions (Attack Complexity LOW), requires no authentication (Privileges Required NONE), and needs no user interaction (User Interaction NONE). The scope is Changed, meaning a compromise of the vulnerable UniFi OS component can affect resources beyond it — the attacker can reach and control the wider network the device governs. All three impact metrics are HIGH: an attacker can read sensitive configuration and traffic data (Confidentiality), tamper with device firmware, rules, and routing (Integrity), and disrupt or disable network connectivity entirely (Availability). With an EPSS score of 0.78555 in the 99.5th percentile, exploitation is highly likely and, given the KEV listing and reports of in-the-wild Mirai botnet abuse, is already occurring — organizations running affected UniFi OS devices should treat CVE-2026-34910 as a critical, time-sensitive emergency.
Exploit Maturity
Public exploit information is available for CVE-2026-34910 via pwndefend.com, which documents active exploitation in the wild and the use of the vulnerability to build a Mirai botnet from compromised UniFi OS devices. CISA has confirmed active exploitation by adding CVE-2026-34910 to the Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 2026-06-26; while the KEV ransomware status is currently listed as Unknown, botnet enrollment of edge devices is a serious and immediate threat. The EPSS score of 0.78555 places CVE-2026-34910 in the 99.5th percentile, indicating a very high, near-certain likelihood of ongoing exploitation activity. Organizations should assume attacks are actively underway and patch every affected UniFi OS device without delay.
Remediation
- Apply the vendor security update immediately. Per CISA's KEV required action, apply mitigations in accordance with Ubiquiti's instructions and comply with BOD 26-04 patching guidance; if a fix cannot be applied, discontinue use of the exposed device. Consult the Ubiquiti Security Advisory Bulletin at community.ui.com for the specific update. The federal remediation deadline was 2026-06-26.
- Upgrade to a fixed version. Update UniFi OS Server to version 5.0.8 or later, and update affected UniFi device firmware (UniFi Dream Machine, Dream Machine Pro, Dream Router, Cloud Gateway, Enterprise Fortress Gateway, Network Video Recorder, Express 7, and related models) to firmware version 5.1.12 or later.
- Restrict network exposure. Ensure UniFi OS management interfaces are not reachable from the internet; place devices behind a firewall, restrict access to trusted management networks only, and disable remote/cloud access where it is not strictly required until every device is patched.
- Hunt for compromise. Given confirmed in-the-wild Mirai botnet exploitation, review device and network logs for unexpected outbound connections, unknown processes, configuration changes, and signs of botnet enrollment; reset credentials and rebuild any device suspected of compromise, since command injection can persist beyond a simple reboot.
- Harden input validation long-term. As a defense-in-depth measure, enforce strict allowlist-based input validation at all trust boundaries and segment IoT/network appliances away from sensitive internal systems so that a single compromised edge device cannot be used to pivot across the environment.
Technical Details
CVE-2026-34910 is a command injection vulnerability in Ubiquiti UniFi OS that arises from improper input validation (CWE-20): the device accepts network-supplied input without verifying that it has the properties required to be processed safely, then incorporates that input into an operating-system command context. Because the unvalidated data is interpreted rather than treated as inert, an attacker can embed shell metacharacters or command sequences in the input to break out of the intended context and execute arbitrary commands with the device's privileges. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H shows the attack is network-borne, low-complexity, entirely unauthenticated, and requires no user interaction, while the Changed scope and triple-HIGH impact reflect that code execution on an edge networking device compromises confidentiality, integrity, and availability across the systems it protects. This combination of an unauthenticated network vector and full command execution is what drives the maximum 10.0 CRITICAL rating.
Frequently Asked Questions
Is CVE-2026-34910 being actively exploited?
Yes. CVE-2026-34910 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, with a remediation deadline of 2026-06-26. A public report on pwndefend.com describes the vulnerability being used to build a Mirai botnet from compromised UniFi OS devices, and its EPSS score of 0.78555 (99.5th percentile) indicates a very high likelihood of continued exploitation.
What products are affected by CVE-2026-34910?
CVE-2026-34910 affects Ubiquiti UniFi OS devices. This includes UniFi OS Server before version 5.0.8, and firmware before 5.1.12 on the UniFi Dream Machine, Dream Machine Pro, Dream Machine Special Edition, Dream Machine Pro Max, Dream Wall, Dream Router, Dream Router 7, Dream Router 5G Max, Express 7, Cloud Gateway (Ultra, Max, Fiber, Industrial), Enterprise Fortress Gateway, and the UniFi and Enterprise Network Video Recorder models.
How do I fix CVE-2026-34910?
Apply Ubiquiti's security update per the vendor advisory: upgrade UniFi OS Server to 5.0.8 or later and affected device firmware to 5.1.12 or later. While patching, restrict management-interface exposure, disable unnecessary remote access, and review logs for signs of Mirai botnet compromise as detailed in the Remediation section.
How severe is CVE-2026-34910?
CVE-2026-34910 is rated CRITICAL with the maximum CVSS 3.1 score of 10.0. It allows unauthenticated remote command injection with no user interaction and full HIGH impact to confidentiality, integrity, and availability across a Changed scope. Its inclusion in the KEV catalog, confirmed Mirai botnet exploitation, and 99.5th-percentile EPSS score make it one of the highest-priority vulnerabilities to remediate immediately.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.