Loading story…
Researchers at Bishop Fox confirmed that multiple flaws in Ubiquiti UniFi OS Server can be chained into unauthenticated remote code execution that yields full root access on exposed systems. The attack combines an authentication bypass and path traversal in the Nginx/unifi-core request flow—tracked as CVE-2026-34908 and CVE-2026-34909—with a command injection bug in the package-update service, CVE-2026-34910, and can be triggered through a reachable web request against internet-facing management interfaces. Researchers said the chain was validated end-to-end and can also leverage overly permissive sudo rights to complete privilege escalation.
Successful exploitation can expose stored secrets, enable forged administrative sessions that may persist after patching, and create downstream risk for managed network gear, door-access systems, and surveillance cameras connected through the platform. Ubiquiti said fixes were released in patched UniFi OS Server versions, including protections such as URI normalization, stricter package-name validation, removal of shell-based backend behavior, and reduced passwordless sudo permissions. Defenders are being urged to patch immediately, rotate credentials and secrets, review systems for signs of prior compromise, and limit or remove public exposure of UniFi management interfaces.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-10, Ubiquiti published a security advisory covering vulnerabilities across multiple UniFi and related products, including UID Enterprise Agent, UniFi OS devices and consoles, UniFi OS Server, UDM-Beast, UNAS models, and Express. The advisory identified affected version ranges and directed users to apply the necessary updates.
Bishop Fox released a detection script to help defenders identify UniFi OS Server instances exposed to the patched vulnerability chain. The researchers advised upgrading to UniFi OS Server 5.0.8 or later and investigating systems for signs of compromise.
Bishop Fox confirmed that multiple UniFi OS Server vulnerabilities could be chained into unauthenticated remote code execution leading to full root access. The researchers validated the chain end-to-end and reported impacts including exposed secrets, forged persistent administrative sessions, and potential compromise of managed devices.
Ubiquiti fixed the vulnerability chain in UniFi OS Server by adding URI-normalization protections, package-name validation, and reducing passwordless sudo permissions. One source identifies the fixed version as 3.2.12, while another reports fixes in version 5.0.8.
Ubiquiti disclosed Security Advisory Bulletin SAB-013 covering five vulnerabilities across the UniFi OS device family. The key flaws included issues that could be chained for unauthenticated remote code execution and were described as critical.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecyber.gc.ca
Open sourcegithub.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcebishopfox.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ubiquiti released security updates for **UniFi OS** to fix five vulnerabilities affecting widely deployed products including **UniFi Cloud Gateway, UniFi Dream Machine, UNVR, NAS devices, consoles, and UniFi OS Server**. Three flaws—`CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`—were rated **CVSS 10.0** and could be exploited by remote, unauthenticated attackers to change system settings, read sensitive files through path traversal, or trigger command injection that could lead to remote code execution. Two additional issues, `CVE-2026-33000` and `CVE-2026-34911`, could also enable command injection, path traversal, privilege escalation, persistence, and data theft under certain conditions. The vulnerabilities were reported through **HackerOne**, and Ubiquiti said they can be exploited with low complexity, although it did not say whether they had been abused before patches were issued. Government and national CERT advisories, including Canada’s Cyber Centre and Germany’s dCERT, directed administrators to review Ubiquiti bulletin 064 and apply updated firmware and software versions immediately. The risk is amplified by the large number of Internet-exposed UniFi OS systems—reportedly close to **100,000**—because these appliances often sit at the network edge and can provide attackers with a path into internal environments if management interfaces are publicly reachable.
Jun 29, 2026
Ubiquiti disclosed and patched two vulnerabilities in the **UniFi Network Application**, including **CVE-2026-22557**, a **critical path traversal flaw** with a **CVSS score of 10.0** that can be exploited by an unauthenticated attacker with network access. The flaw allows access to files on the underlying system, which can then be manipulated to gain access to an underlying account and potentially seize administrative control of the host. A second issue, **CVE-2026-22558**, is a **high-severity authenticated NoSQL injection vulnerability** rated **7.7** that can allow privilege escalation by attackers who already have valid access. Affected releases include **UniFi Network Application 10.1.85 and earlier, 10.2.93 and earlier, and 9.0.114 and earlier**. Ubiquiti says organizations should upgrade to **10.1.89 or later**, **10.2.97 or later**, or update **UniFi Express firmware to 4.0.13 or later**, which brings the application to **9.0.118 or later**. Reporting across the sources consistently describes the first flaw as enabling account takeover or full compromise of the underlying system, while the second provides a post-authentication escalation path; one source also notes the critical bug was reported by researcher **n00r3 (@izn0u)**, and another highlights asset discovery guidance for identifying exposed **Ubiquiti UniFi Network** deployments.
Jul 2, 2026
Ubiquiti disclosed two high-severity vulnerabilities affecting separate UniFi product lines, including a cross-site scripting issue in **UniFi Network Server** tracked as `CVE-2026-22559` and a path traversal flaw in **UniFi Play** tracked as `CVE-2026-22562`. The Network Server bug stems from improper input validation and can enable unauthorized account access if a user is socially engineered into clicking a malicious link. It affects **UniFi Network Server 10.1.85 and earlier**, with remediation available in **10.1.89 or later**. The more severe UniFi Play issue could let an attacker with access to the UniFi Play network write files to the device through path traversal, creating a path to remote code execution via malicious firmware file writes. Affected products include **UniFi Play PowerAmp 1.0.35 and earlier** and **UniFi Play Audio Port 1.0.24 and earlier**. Ubiquiti recommends upgrading PowerAmp to **1.0.38 or later** and Audio Port to **1.1.9 or later** to mitigate the exposure.
Jun 29, 2026