{"id":"CVE-2026-34908","kind":"vulnerability","aliases":["CVE-2026-34908"],"related":[],"title":"A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi…","description":"Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Ubiquiti UniFi OS contains an improper access control flaw that lets a malicious actor with network access make unauthorized changes to the system. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-06-23T00:00:00+00:00","products":[{"name":"Ubiquiti UniFi OS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ui unifi os server","fixed":["5.0.8"],"affected":"< 5.0.8","ecosystem":"vendor"},{"name":"ui unifi cloud gateway industrial firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine pro firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine special edition firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine pro max firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui enterprise fortress gateway firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream wall firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream router firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream router 7 firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi express 7 firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder pro firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder instant firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui enterprise network video recorder firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloud gateway ultra firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloud gateway max firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloud gateway fiber firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream router 5g max firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui enterprise network video recorder core firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloud key plus firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloudkey firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloudkey enterprise firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder g2 firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder g2 pro firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine beast firmware","fixed":["5.1.11"],"affected":"< 5.1.11","ecosystem":"vendor"},{"name":"ui unas 2 firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unas 4 firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unas pro firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unas pro 4 firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unas pro 8 firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","network-infrastructure","self-hosted","ubiquiti","unifi-os"],"not_affected_if":["no-unifi-os-devices"],"how_to_check":"Identify UniFi OS consoles and gateways on your network and record their firmware/UniFi OS versions; unknown whether the sources list affected version ranges.","fix":"Apply the mitigation or patched UniFi OS version per Ubiquiti's vendor instructions; if no mitigation is available, discontinue use of the affected product per CISA guidance. Fixed version: unknown.","status":"open","published_at":"2026-05-22T02:16:34+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:49+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:33:49Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation or patched UniFi OS version per Ubiquiti's vendor instructions; if no mitigation is available, discontinue use of the affected product per CISA guidance. Fixed version: unknown.","summary":"Ubiquiti UniFi OS contains an improper access control flaw that lets a malicious actor with network access make unauthorized changes to the system. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["ubiquiti","unifi-os","self-hosted","network-infrastructure"],"confidence":0.6,"analyst_note":"Find the affected and fixed UniFi OS version ranges and Ubiquiti's advisory from the CISA KEV entry and Ubiquiti security bulletins; sources do not list versions.","how_to_check":"Identify UniFi OS consoles and gateways on your network and record their firmware/UniFi OS versions; unknown whether the sources list affected version ranges.","needs_analyst":true,"not_affected_if":["no-unifi-os-devices"],"severity_if_unknown":"high"},"cost_usd":0.000408,"input_tokens":2206,"output_tokens":375,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':293C,319C,350C '-2026':20A,23A '-34908':21A,24A '2':185A '26':292C,318C,349C '4':189A,198A '5g':137A '7':82A,87A '8':203A 'access':5A,13A,223B,233B,255C,265C 'accord':282C 'action':278C 'activ':244B 'actor':3A,230B,263C 'adher':346C 'allow':260C 'appli':279C 'applic':316C 'asset':340C 'base':297C 'beast':181A 'bod':291C,317C,348C 'chang':236B,272C 'cisa':240B,276C,289C,306C 'cloud':34A,117A,123A,129A,149A,322C 'cloudkey':155A,159A 'complianc':287C 'contain':220B,252C 'control':14A,224B,256C 'core':145A 'could':9A,259C 'cve':19A,22A 'discontinu':325C 'dream':40A,45A,51A,58A,70A,75A,80A,135A,179A 'edition':54A 'ensur':286C,345C 'enterprise':64A,110A,141A,160A 'evalu':338C 'exploit':10A,205B,245B 'exposur':343C 'express':86A 'fiber':131A 'firmware':37A,42A,48A,55A,62A,67A,72A,77A,83A,88A,94A,101A,108A,114A,120A,126A,132A,139A,146A,152A,156A,161A,168A,176A,182A,186A,190A,194A,199A,204A 'flaw':225B 'follow':315C 'forens':308C 'fortress':65A 'found':16A 'g2':167A,174A 'gateway':35A,66A,118A,124A,130A 'guidanc':304C,320C 'guidelin':352C 'host':212B 'improp':12A,222B,254C 'industrial':36A 'infrastructur':206B,209B 'instant':107A 'instruct':285C 'internet':342C 'key':150A 'let':227B 'list':241B 'machine':41A,46A,52A,59A,180A 'make':234B,270C 'malici':2A,229B,262C 'max':61A,125A,138A 'mitig':280C,331C 'network':8A,91A,97A,104A,111A,142A,164A,171A,208B,232B,268C 'network-infrastructur':207B 'note':303C,314C 'os':27A,30A,216B,219B,251C 'patch':351C 'plus':151A 'priorit':294C 'pro':47A,60A,100A,175A,193A,197A,202A 'product':329C 'recorder':93A,99A,106A,113A,144A,166A,173A 'requir':277C,310C 'respons':336C 'risk':299C 'router':76A,81A,136A 'secur':295C 'see':300C,311C 'self':211B 'self-host':210B 'server':31A 'servic':323C 'special':53A 'stakehold':334C 'system':239B,275C 'triag':309C 'ubiqu':213B,217B,249C 'ubiquiti':25A 'ui':28A,32A,38A,43A,49A,56A,63A,68A,73A,78A,84A,89A,95A,102A,109A,115A,121A,127A,133A,140A,147A,153A,157A,162A,169A,177A,183A,187A,191A,195A,200A 'ultra':119A 'unas':184A,188A,192A,196A,201A 'unauthor':235B,271C 'unavail':333C 'unifi':18A,26A,29A,33A,39A,44A,50A,57A,69A,74A,79A,85A,90A,96A,103A,116A,122A,128A,134A,148A,154A,158A,163A,170A,178A,215B,218B,250C 'unifi-o':214B 'updat':296C 'url':301C,312C 'use':326C 'vendor':284C 'video':92A,98A,105A,112A,143A,165A,172A 'vulner':15A,257C 'wall':71A 'wild':248B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-22T02:16:34+00:00","kev":{"dateAdded":"2026-06-23","dueDate":"2026-06-26","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-34908","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34908","severity":null,"published_at":"2026-06-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-34908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34908","severity":null,"published_at":"2026-05-22T02:16:34+00:00","modified_at":"2026-07-23T16:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}