rewindex

RewindexCVEs

CVE-2026-34908: Ubiquiti UniFi OS Improper Access Control Vulnerability

Critical · CVSS 10.0 (CVSS 3.1)KEV known exploitedEPSS 88.3%, 100th percentilePublished Updated Assigner: hackerone

In CISA’s Known Exploited Vulnerabilities catalog: Ubiquiti UniFi OS Improper Access Control Vulnerability.

Added , federal remediation due . Known ransomware use: Unknown.

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Description

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · CWE-284

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

Ubiquiti Inc: EFGUbiquiti Inc: ENVRUbiquiti Inc: ENVR-CoreUbiquiti Inc: Express 7Ubiquiti Inc: UCG-FiberUbiquiti Inc: UCG-IndustrialUbiquiti Inc: UCG-MaxUbiquiti Inc: UCG-UltraUbiquiti Inc: UCKUbiquiti Inc: UCK-EnterpriseUbiquiti Inc: UCKPUbiquiti Inc: UDMUbiquiti Inc: UDM-BeastUbiquiti Inc: UDM-ProUbiquiti Inc: UDM-Pro-MaxUbiquiti Inc: UDM-SEUbiquiti Inc: UDRUbiquiti Inc: UDR-5GUbiquiti Inc: UDR7Ubiquiti Inc: UDWUbiquiti Inc: UNAS-2Ubiquiti Inc: UNAS-4Ubiquiti Inc: UNAS-ProUbiquiti Inc: UNAS-Pro-4Ubiquiti Inc: UNAS-Pro-8Ubiquiti Inc: UniFi OS ServerUbiquiti Inc: UNVRUbiquiti Inc: UNVR-G2Ubiquiti Inc: UNVR-G2-ProUbiquiti Inc: UNVR-InstantUbiquiti Inc: UNVR-Pro

References

All CVEsMarkdownJSON