by Kastro
Paper/Archive/CVE-2026-34908

CVE-2026-34908

Ubiquiti Inc UniFi OS Server — Ubiquiti UniFi OS Improper Access Control Vulnerability

KEV · due 26 JunEPSS 88%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 99.8.998 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

Affected

ProductAffectedFixed inSource
UniFi OS Server< 5.0.85.0.8CNA
UDM< 5.1.125.1.12CNA
UDM-Pro< 5.1.125.1.12CNA
UDM-SE< 5.1.125.1.12CNA
UDM-Pro-Max< 5.1.125.1.12CNA
UDM-Beast< 5.1.115.1.11CNA
EFG< 5.1.125.1.12CNA
UDW< 5.1.125.1.12CNA
UDR< 5.1.125.1.12CNA
UDR7< 5.1.125.1.12CNA
UDR-5G< 5.1.125.1.12CNA
Express 7< 5.1.125.1.12CNA

Scores by source

hackerone (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refcommunity.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963bwriteuppwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirairefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908kevcisa.gov/known-exploited-vulnerabilities-catalog