Loading story…
Ubiquiti released security updates for UniFi OS to fix five vulnerabilities affecting widely deployed products including UniFi Cloud Gateway, UniFi Dream Machine, UNVR, NAS devices, consoles, and UniFi OS Server. Three flaws—CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910—were rated CVSS 10.0 and could be exploited by remote, unauthenticated attackers to change system settings, read sensitive files through path traversal, or trigger command injection that could lead to remote code execution. Two additional issues, CVE-2026-33000 and CVE-2026-34911, could also enable command injection, path traversal, privilege escalation, persistence, and data theft under certain conditions.
The vulnerabilities were reported through HackerOne, and Ubiquiti said they can be exploited with low complexity, although it did not say whether they had been abused before patches were issued. Government and national CERT advisories, including Canada’s Cyber Centre and Germany’s dCERT, directed administrators to review Ubiquiti bulletin 064 and apply updated firmware and software versions immediately. The risk is amplified by the large number of Internet-exposed UniFi OS systems—reportedly close to 100,000—because these appliances often sit at the network edge and can provide attackers with a path into internal environments if management interfaces are publicly reachable.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-22, the Canadian Centre for Cyber Security published advisory AV26-498 urging administrators to review Ubiquiti's bulletin and apply the available updates. The notice highlighted the broad range of affected UniFi product families and vulnerable versions.
On 2026-05-22, CVE records including CVE-2026-34908, CVE-2026-34909, and CVE-2026-33000 were published or received in public vulnerability feeds, documenting improper access control, path traversal, and command injection issues in UniFi OS. The entries referenced Ubiquiti's Security Advisory Bulletin 064 and assigned critical severity metrics.
Ubiquiti released security updates for UniFi OS to fix five flaws affecting products such as UniFi Cloud Gateway, UniFi Dream Machine, UNVR, and UniFi OS Server. The issues included three critical unauthenticated bugs and two additional vulnerabilities that could enable command injection, path traversal, privilege escalation, or data theft.
On 2026-05-21, Ubiquiti published a security advisory covering multiple vulnerabilities across UniFi products, including UniFi OS-based gateways, consoles, NVRs, NAS devices, and UniFi OS Server. The advisory provided remediation guidance and linked to updated security releases.
On 2026-03-19, Cybernews reported a critical vulnerability in Ubiquiti's UniFi Network Application that could allow unauthenticated compromise. This appears to be a separate issue from the later May 2026 UniFi OS vulnerabilities already captured in the timeline.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcecyber.gc.ca
Open sourcebleepingcomputer.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecybernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ubiquiti disclosed and patched two vulnerabilities in the **UniFi Network Application**, including **CVE-2026-22557**, a **critical path traversal flaw** with a **CVSS score of 10.0** that can be exploited by an unauthenticated attacker with network access. The flaw allows access to files on the underlying system, which can then be manipulated to gain access to an underlying account and potentially seize administrative control of the host. A second issue, **CVE-2026-22558**, is a **high-severity authenticated NoSQL injection vulnerability** rated **7.7** that can allow privilege escalation by attackers who already have valid access. Affected releases include **UniFi Network Application 10.1.85 and earlier, 10.2.93 and earlier, and 9.0.114 and earlier**. Ubiquiti says organizations should upgrade to **10.1.89 or later**, **10.2.97 or later**, or update **UniFi Express firmware to 4.0.13 or later**, which brings the application to **9.0.118 or later**. Reporting across the sources consistently describes the first flaw as enabling account takeover or full compromise of the underlying system, while the second provides a post-authentication escalation path; one source also notes the critical bug was reported by researcher **n00r3 (@izn0u)**, and another highlights asset discovery guidance for identifying exposed **Ubiquiti UniFi Network** deployments.
Jul 2, 2026
CISA added four vulnerabilities affecting **Ubiquiti UniFi OS** and **Lantronix EDS5000** devices to its Known Exploited Vulnerabilities catalog after reports of active exploitation. The Ubiquiti issues—`CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`—are all rated **CVSS 10.0** and were patched in UniFi OS Server version **5.0.8**. Researchers said `CVE-2026-34908` and `CVE-2026-34909` involve an **NGINX authentication gateway bypass** that can be chained with `CVE-2026-34910`, an improper input validation flaw, to achieve **unauthenticated command injection** and unauthorized system changes. Users reported apparent zero-day exploitation that created rogue administrator accounts named **"John Sim"** during automated reconnaissance. CISA also added `CVE-2025-67038` in the **Lantronix EDS5000**, an HTTP RPC username sanitization flaw that can allow **arbitrary OS command execution with root privileges**. Because UniFi OS devices centrally manage network infrastructure, successful compromise could give attackers a path for broader lateral movement inside enterprise environments. CISA directed federal agencies to remediate the newly listed flaws under binding directives, with deadlines including **June 26, 2026** for the affected systems, and urged organizations beyond government to review the KEV catalog and patch exposed devices promptly.
Jun 29, 2026
Researchers at **Bishop Fox** confirmed that multiple flaws in **Ubiquiti UniFi OS Server** can be chained into **unauthenticated remote code execution** that yields full **root** access on exposed systems. The attack combines an authentication bypass and path traversal in the Nginx/`unifi-core` request flow—tracked as `CVE-2026-34908` and `CVE-2026-34909`—with a command injection bug in the `package-update` service, `CVE-2026-34910`, and can be triggered through a reachable web request against internet-facing management interfaces. Researchers said the chain was validated end-to-end and can also leverage overly permissive sudo rights to complete privilege escalation. Successful exploitation can expose stored secrets, enable forged administrative sessions that may persist after patching, and create downstream risk for managed network gear, door-access systems, and surveillance cameras connected through the platform. Ubiquiti said fixes were released in patched UniFi OS Server versions, including protections such as URI normalization, stricter package-name validation, removal of shell-based backend behavior, and reduced passwordless sudo permissions. Defenders are being urged to patch immediately, rotate credentials and secrets, review systems for signs of prior compromise, and limit or remove public exposure of UniFi management interfaces.
Jun 29, 2026