CriticalCISA KEVExploited in the wildPublic exploit

Ubiquiti UniFi OS Path Traversal Vulnerability

IdentifiersCVE-2026-34909CWE-22· Improper Limitation of a Pathname…

CVE-2026-34909 is a path traversal vulnerability in Ubiquiti UniFi OS devices. According to the provided content, a malicious actor with network access can exploit the flaw to access files on the underlying operating system outside the intended directory scope. Multiple sources in the content state that the issue affects the UniFi OS authentication gateway and can be used to expose sensitive host files, including configuration data and credentials, and that the accessed files may be manipulated to obtain access to an underlying system account. Bishop Fox analysis cited in the content further indicates that CVE-2026-34909 can be combined with CVE-2026-34908 to bypass authentication and reach internal routes that should require authorization, and then chained with CVE-2026-34910 for unauthenticated remote code execution with full root privileges. The content also states the issue was fixed by Ubiquiti in UniFi OS Server 5.0.8 and corresponding fixed releases for affected appliance lines.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can expose sensitive files from the underlying operating system, including configuration files, credentials, and other data useful for follow-on compromise. The content indicates attackers may also manipulate accessed files to gain access to an underlying account. In practice, this vulnerability materially contributes to complete device compromise when chained with CVE-2026-34908 and CVE-2026-34910, enabling unauthenticated remote code execution and eventual full root access on vulnerable UniFi OS systems. Because UniFi OS commonly manages network infrastructure, successful compromise can also facilitate lateral movement, credential theft, traffic tampering, and broader enterprise compromise.

Mitigation

If you can’t patch tonight, do this now.

Until patching is completed, restrict or eliminate exposure of the UniFi OS management interface to untrusted networks and the public internet. The content specifically notes the risk from internet-exposed web interfaces and recommends avoiding external exposure of the UniFi Management console, using remote management alternatives where appropriate, and increasing monitoring for suspicious requests involving encoded traversal sequences and access to affected routes. If compromise is suspected, maintain forensic triage, review external telemetry because host logs may be altered by attackers, and rotate sensitive material such as signing keys, TLS keys, cloud tokens, and database credentials after containment.

Remediation

Patch, then assume compromise.

Apply Ubiquiti's security updates immediately. The provided content states UniFi OS Server should be upgraded to version 5.0.8 or later, and affected UniFi OS appliance families should be updated to the vendor-fixed releases referenced in Security Advisory Bulletin 064, including 5.1.12 or later for many hardware lines, 5.1.10 or later for UNAS models, 5.1.11 or later for UDM-Beast, and 4.0.14 or later for Express where applicable. Because the content notes active exploitation and warns that patching does not remediate historic compromise, organizations should also investigate for prior compromise, rebuild from a known-good image where compromise is suspected, and rotate secrets that may have been exposed from the host.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

UbiquitiExpressoperating_system

UbiquitiUnifi Osapplication

UbiquitiUnifi Os Serveroperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

43 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

43 SOURCESView more in app

cyberthroneNews

Jun 26, 2026

CISA’s KEV Wave: Ubiquiti, Lantronix, and Cisco Unified CM Join the List - TheCyberThrone

A path traversal vulnerability in Ubiquiti UniFi OS that allows file access or manipulation outside intended directories and can lead to access to underlying user accounts.

cysecurity newsNews

Jun 25, 2026

Ubiquiti UniFi OS Flaw Under Active Exploitation CISA Alerts Users - CySecurity News - Latest Information Security and Hacking Incidents

A path traversal vulnerability in Ubiquiti UniFi OS that can expose underlying operating system files, credentials, and configuration data, and can be chained with other flaws for broader compromise.

the hacker newsNews

Jun 24, 2026

CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited

A path traversal vulnerability in Ubiquiti UniFi OS that can allow a malicious actor with network access to access files on the underlying system and manipulate them to access an underlying account. It is part of a three-vulnerability RCE chain.

security weekNews

Jun 24, 2026

Critical Ubiquiti Vulnerabilities in Attackers' Crosshairs - SecurityWeek

A critical path traversal vulnerability in Ubiquiti UniFi OS that can let attackers access and manipulate files on the underlying operating system to reach underlying accounts. Patch analysis indicates it is also part of the authentication gateway bypass rooted in NGINX request processing.

+12 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware3

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity24

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-34909

NVD

nvd.nist.gov/vuln/detail/CVE-2026-34909

MITRE CWE · CWE-22

Improper Limitation of a Pathname to a…

community.ui.com

community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b