Loading story…
CISA added four vulnerabilities affecting Ubiquiti UniFi OS and Lantronix EDS5000 devices to its Known Exploited Vulnerabilities catalog after reports of active exploitation. The Ubiquiti issues—CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910—are all rated CVSS 10.0 and were patched in UniFi OS Server version 5.0.8. Researchers said CVE-2026-34908 and CVE-2026-34909 involve an NGINX authentication gateway bypass that can be chained with CVE-2026-34910, an improper input validation flaw, to achieve unauthenticated command injection and unauthorized system changes. Users reported apparent zero-day exploitation that created rogue administrator accounts named "John Sim" during automated reconnaissance.
CISA also added CVE-2025-67038 in the Lantronix EDS5000, an HTTP RPC username sanitization flaw that can allow arbitrary OS command execution with root privileges. Because UniFi OS devices centrally manage network infrastructure, successful compromise could give attackers a path for broader lateral movement inside enterprise environments. CISA directed federal agencies to remediate the newly listed flaws under binding directives, with deadlines including June 26, 2026 for the affected systems, and urged organizations beyond government to review the KEV catalog and patch exposed devices promptly.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Forescout Research’s Vedere Labs reported that attackers exploited CVE-2025-67038 in Lantronix EDS5000 devices after a vendor patch was released but before public disclosure, suggesting likely patch reverse engineering. The researchers linked the activity to a broader cluster they track as Chaya_006 and described the behavior as targeted and automated.
Forescout publicly disclosed CVE-2025-67038 in April 2026 as part of its BRIDGE:BREAK research on 20 vulnerabilities affecting Lantronix and Silex serial-to-IP products. The research warned that flaws in this device class could enable command execution and disruption or manipulation in industrial and healthcare environments.
Bishop Fox reported that CVE-2026-34908 and CVE-2026-34909 involve an NGINX authentication gateway bypass using crafted requests. It said those flaws can be chained with CVE-2026-34910 to achieve unauthenticated command injection.
Users reported that the three critical UniFi OS vulnerabilities had already been exploited in the wild, likely as zero-days. The activity reportedly created rogue administrator accounts named 'John Sim' and appeared to be automated reconnaissance.
Following the KEV additions, CISA directed federal agencies to remediate the affected systems under binding directives. One report says FCEB agencies were given a deadline of June 26, 2026, while another says agencies were ordered to patch the Ubiquiti flaws within three days.
CISA added CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, and CVE-2025-67038 to its Known Exploited Vulnerabilities catalog, citing active exploitation risk. The additions covered Ubiquiti UniFi OS and the Lantronix EDS5000 plugin.
Beazley Security reported that active exploitation of CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 included Mirai/Gaafgyt botnet activity targeting externally exposed UniFi OS web interfaces, especially on TCP 11443. The advisory said attackers chained the nginx authentication bypass and package-update command injection flaws, then escalated to root via passwordless sudo permissions on sensitive binaries such as dpkg.
Ubiquiti patched CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 in UniFi OS Server version 5.0.8. SecurityWeek states the fixes were released on May 21, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourcesecurityweek.com
Open sourcecysecurity.news
Open sourcethehackernews.com
Open sourcelabs.beazley.security
Open sourcebleepingcomputer.com
Open sourcecisa.gov
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **CVE-2026-20253** in Splunk Enterprise to its Known Exploited Vulnerabilities catalog after confirming active exploitation of the missing-authentication flaw, warning that successful exploitation could give attackers access to critical functions and potentially total control of exposed systems. The agency said the vulnerability type is a common intrusion vector and directed Federal Civilian Executive Branch agencies to rapidly remediate affected public-facing assets under **Binding Operational Directive 26-04**, while also checking whether systems were already compromised before patches were applied. CISA also warned that multiple **Ubiquiti UniFi OS** flaws have been added to the KEV catalog, including **CVE-2026-34908** for improper access control, **CVE-2026-34909** for path traversal, and **CVE-2026-34910** for improper input validation that could enable command injection. The agency said at least one of the UniFi flaws is being actively exploited and cautioned that the bugs could be chained to disable security controls, alter network behavior, steal credentials, tamper with traffic, and support lateral movement, prompting urgent patching of internet-exposed management interfaces.
Jun 29, 2026
Ubiquiti released security updates for **UniFi OS** to fix five vulnerabilities affecting widely deployed products including **UniFi Cloud Gateway, UniFi Dream Machine, UNVR, NAS devices, consoles, and UniFi OS Server**. Three flaws—`CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`—were rated **CVSS 10.0** and could be exploited by remote, unauthenticated attackers to change system settings, read sensitive files through path traversal, or trigger command injection that could lead to remote code execution. Two additional issues, `CVE-2026-33000` and `CVE-2026-34911`, could also enable command injection, path traversal, privilege escalation, persistence, and data theft under certain conditions. The vulnerabilities were reported through **HackerOne**, and Ubiquiti said they can be exploited with low complexity, although it did not say whether they had been abused before patches were issued. Government and national CERT advisories, including Canada’s Cyber Centre and Germany’s dCERT, directed administrators to review Ubiquiti bulletin 064 and apply updated firmware and software versions immediately. The risk is amplified by the large number of Internet-exposed UniFi OS systems—reportedly close to **100,000**—because these appliances often sit at the network edge and can provide attackers with a path into internal environments if management interfaces are publicly reachable.
Jun 29, 2026
Ubiquiti disclosed and patched two vulnerabilities in the **UniFi Network Application**, including **CVE-2026-22557**, a **critical path traversal flaw** with a **CVSS score of 10.0** that can be exploited by an unauthenticated attacker with network access. The flaw allows access to files on the underlying system, which can then be manipulated to gain access to an underlying account and potentially seize administrative control of the host. A second issue, **CVE-2026-22558**, is a **high-severity authenticated NoSQL injection vulnerability** rated **7.7** that can allow privilege escalation by attackers who already have valid access. Affected releases include **UniFi Network Application 10.1.85 and earlier, 10.2.93 and earlier, and 9.0.114 and earlier**. Ubiquiti says organizations should upgrade to **10.1.89 or later**, **10.2.97 or later**, or update **UniFi Express firmware to 4.0.13 or later**, which brings the application to **9.0.118 or later**. Reporting across the sources consistently describes the first flaw as enabling account takeover or full compromise of the underlying system, while the second provides a post-authentication escalation path; one source also notes the critical bug was reported by researcher **n00r3 (@izn0u)**, and another highlights asset discovery guidance for identifying exposed **Ubiquiti UniFi Network** deployments.
Jul 2, 2026