Loading story…
CISA added CVE-2026-20253 in Splunk Enterprise to its Known Exploited Vulnerabilities catalog after confirming active exploitation of the missing-authentication flaw, warning that successful exploitation could give attackers access to critical functions and potentially total control of exposed systems. The agency said the vulnerability type is a common intrusion vector and directed Federal Civilian Executive Branch agencies to rapidly remediate affected public-facing assets under Binding Operational Directive 26-04, while also checking whether systems were already compromised before patches were applied.
CISA also warned that multiple Ubiquiti UniFi OS flaws have been added to the KEV catalog, including CVE-2026-34908 for improper access control, CVE-2026-34909 for path traversal, and CVE-2026-34910 for improper input validation that could enable command injection. The agency said at least one of the UniFi flaws is being actively exploited and cautioned that the bugs could be chained to disable security controls, alter network behavior, steal credentials, tamper with traffic, and support lateral movement, prompting urgent patching of internet-exposed management interfaces.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Under Binding Operational Directive 26-04, federal civilian agencies were told to remediate the affected Ubiquiti UniFi OS vulnerabilities by June 26, 2026. The notice emphasized the risk of unauthorized system changes, path traversal, and possible command injection if the flaws are chained.
CISA added multiple Ubiquiti UniFi OS vulnerabilities to its Known Exploited Vulnerabilities Catalog, including CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, and warned that at least one is being actively exploited in the wild. Affected organizations, especially those with internet-exposed UniFi management interfaces, were urged to prioritize patching.
CISA added CVE-2026-20253, a Splunk Enterprise missing-authentication vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The agency said the flaw poses significant risk and directed federal agencies to prioritize remediation under BOD 26-04.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added four vulnerabilities affecting **Ubiquiti UniFi OS** and **Lantronix EDS5000** devices to its Known Exploited Vulnerabilities catalog after reports of active exploitation. The Ubiquiti issues—`CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`—are all rated **CVSS 10.0** and were patched in UniFi OS Server version **5.0.8**. Researchers said `CVE-2026-34908` and `CVE-2026-34909` involve an **NGINX authentication gateway bypass** that can be chained with `CVE-2026-34910`, an improper input validation flaw, to achieve **unauthenticated command injection** and unauthorized system changes. Users reported apparent zero-day exploitation that created rogue administrator accounts named **"John Sim"** during automated reconnaissance. CISA also added `CVE-2025-67038` in the **Lantronix EDS5000**, an HTTP RPC username sanitization flaw that can allow **arbitrary OS command execution with root privileges**. Because UniFi OS devices centrally manage network infrastructure, successful compromise could give attackers a path for broader lateral movement inside enterprise environments. CISA directed federal agencies to remediate the newly listed flaws under binding directives, with deadlines including **June 26, 2026** for the affected systems, and urged organizations beyond government to review the KEV catalog and patch exposed devices promptly.
Jun 29, 2026
Ubiquiti released security updates for **UniFi OS** to fix five vulnerabilities affecting widely deployed products including **UniFi Cloud Gateway, UniFi Dream Machine, UNVR, NAS devices, consoles, and UniFi OS Server**. Three flaws—`CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`—were rated **CVSS 10.0** and could be exploited by remote, unauthenticated attackers to change system settings, read sensitive files through path traversal, or trigger command injection that could lead to remote code execution. Two additional issues, `CVE-2026-33000` and `CVE-2026-34911`, could also enable command injection, path traversal, privilege escalation, persistence, and data theft under certain conditions. The vulnerabilities were reported through **HackerOne**, and Ubiquiti said they can be exploited with low complexity, although it did not say whether they had been abused before patches were issued. Government and national CERT advisories, including Canada’s Cyber Centre and Germany’s dCERT, directed administrators to review Ubiquiti bulletin 064 and apply updated firmware and software versions immediately. The risk is amplified by the large number of Internet-exposed UniFi OS systems—reportedly close to **100,000**—because these appliances often sit at the network edge and can provide attackers with a path into internal environments if management interfaces are publicly reachable.
Jun 29, 2026
Ubiquiti disclosed and patched two vulnerabilities in the **UniFi Network Application**, including **CVE-2026-22557**, a **critical path traversal flaw** with a **CVSS score of 10.0** that can be exploited by an unauthenticated attacker with network access. The flaw allows access to files on the underlying system, which can then be manipulated to gain access to an underlying account and potentially seize administrative control of the host. A second issue, **CVE-2026-22558**, is a **high-severity authenticated NoSQL injection vulnerability** rated **7.7** that can allow privilege escalation by attackers who already have valid access. Affected releases include **UniFi Network Application 10.1.85 and earlier, 10.2.93 and earlier, and 9.0.114 and earlier**. Ubiquiti says organizations should upgrade to **10.1.89 or later**, **10.2.97 or later**, or update **UniFi Express firmware to 4.0.13 or later**, which brings the application to **9.0.118 or later**. Reporting across the sources consistently describes the first flaw as enabling account takeover or full compromise of the underlying system, while the second provides a post-authentication escalation path; one source also notes the critical bug was reported by researcher **n00r3 (@izn0u)**, and another highlights asset discovery guidance for identifying exposed **Ubiquiti UniFi Network** deployments.
Jul 2, 2026