{"id":"CVE-2026-34909","kind":"vulnerability","aliases":["CVE-2026-34909"],"related":[],"title":"A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices…","description":"Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Ubiquiti UniFi OS contains a path traversal flaw that lets an attacker with network access read files on the underlying system. Those files can be manipulated to reach an underlying account.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-06-23T00:00:00+00:00","products":[{"name":"Ubiquiti UniFi OS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ui unifi os server","fixed":["5.0.8"],"affected":"< 5.0.8","ecosystem":"vendor"},{"name":"ui unifi cloud gateway industrial firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine pro firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine special edition firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine pro max firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui enterprise fortress gateway firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream wall firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream router firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream router 7 firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi express 7 firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder pro firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder instant firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui enterprise network video recorder firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloud gateway ultra firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloud gateway max firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloud gateway fiber firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream router 5g max firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui enterprise network video recorder core firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloud key plus firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloudkey firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloudkey enterprise firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder g2 firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder g2 pro firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine beast firmware","fixed":["5.1.11"],"affected":"< 5.1.11","ecosystem":"vendor"},{"name":"ui unas 2 firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unas 4 firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unas pro firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unas pro 4 firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unas pro 8 firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unifi express firmware","fixed":["4.0.14"],"affected":"< 4.0.14","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","network-gear","self-hosted","ubiquiti","unifi-os"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor mitigations or patch per Ubiquiti's advisory; if no mitigation exists, discontinue use of the affected product per CISA BOD 26-04 guidance.","status":"open","published_at":"2026-05-22T02:16:34+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:50+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:33:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations or patch per Ubiquiti's advisory; if no mitigation exists, discontinue use of the affected product per CISA BOD 26-04 guidance.","summary":"Ubiquiti UniFi OS contains a path traversal flaw that lets an attacker with network access read files on the underlying system. Those files can be manipulated to reach an underlying account.","category":"infrastructure","who_cares":["unifi-os","ubiquiti","self-hosted","network-gear"],"confidence":0.6,"analyst_note":"Sources give no affected or fixed versions and no vendor advisory URL; find Ubiquiti's advisory and the fixed UniFi OS build, and confirm the exploitation status via the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"severity_if_unknown":"high"},"cost_usd":0.000377,"input_tokens":2216,"output_tokens":311,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':305C,331C,362C '-2026':21A,24A '-34909':22A,25A '2':186A '26':304C,330C,361C '4':190A,199A '5g':138A '7':83A,88A '8':204A 'access':5A,236B,268C,273C,284C 'accord':294C 'account':252B,287C 'action':290C 'actor':3A,266C 'adher':358C 'allow':263C 'appli':291C 'applic':328C 'asset':352C 'attack':233B 'base':309C 'beast':182A 'bod':303C,329C,360C 'cisa':288C,301C,318C 'cloud':35A,118A,124A,130A,150A,334C 'cloudkey':156A,160A 'complianc':299C 'contain':225B,256C 'core':146A 'could':9A,262C,280C 'cve':20A,23A 'devic':19A 'discontinu':337C 'dream':41A,46A,52A,59A,71A,76A,81A,136A,180A 'edition':55A 'ensur':298C,357C 'enterprise':65A,111A,142A,161A 'evalu':350C 'exploit':10A,210B 'exposur':355C 'express':87A,208A 'fiber':132A 'file':238B,244B,274C 'firmware':38A,43A,49A,56A,63A,68A,73A,78A,84A,89A,95A,102A,109A,115A,121A,127A,133A,140A,147A,153A,157A,162A,169A,177A,183A,187A,191A,195A,200A,205A,209A 'flaw':229B 'follow':327C 'forens':320C 'fortress':66A 'found':15A 'g2':168A,175A 'gateway':36A,67A,119A,125A,131A 'gear':214B 'guidanc':316C,332C 'guidelin':364C 'host':217B 'industrial':37A 'infrastructur':211B 'instant':108A 'instruct':297C 'internet':354C 'key':151A 'let':231B 'machine':42A,47A,53A,60A,181A 'malici':2A,265C 'manipul':247B,282C 'max':62A,126A,139A 'mitig':292C,343C 'network':8A,92A,98A,105A,112A,143A,165A,172A,213B,235B,271C 'network-gear':212B 'note':315C,326C 'os':18A,28A,31A,221B,224B,255C 'patch':363C 'path':12A,227B,258C 'plus':152A 'priorit':306C 'pro':48A,61A,101A,176A,194A,198A,203A 'product':341C 'reach':249B 'read':237B 'recorder':94A,100A,107A,114A,145A,167A,174A 'requir':289C,322C 'respons':348C 'risk':311C 'router':77A,82A,137A 'secur':307C 'see':312C,323C 'self':216B 'self-host':215B 'server':32A 'servic':335C 'special':54A 'stakehold':346C 'system':242B,278C 'travers':13A,228B,259C 'triag':321C 'ubiqu':218B,222B,253C 'ubiquiti':26A 'ui':29A,33A,39A,44A,50A,57A,64A,69A,74A,79A,85A,90A,96A,103A,110A,116A,122A,128A,134A,141A,148A,154A,158A,163A,170A,178A,184A,188A,192A,196A,201A,206A 'ultra':120A 'unas':185A,189A,193A,197A,202A 'unavail':345C 'under':241B,251B,277C,286C 'unifi':17A,27A,30A,34A,40A,45A,51A,58A,70A,75A,80A,86A,91A,97A,104A,117A,123A,129A,135A,149A,155A,159A,164A,171A,179A,207A,220B,223B,254C 'unifi-o':219B 'updat':308C 'url':313C,324C 'use':338C 'vendor':296C 'video':93A,99A,106A,113A,144A,166A,173A 'vulner':14A,260C 'wall':72A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-22T02:16:34+00:00","kev":{"dateAdded":"2026-06-23","dueDate":"2026-06-26","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-34909","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34909","severity":null,"published_at":"2026-06-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:54+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-34909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34909","severity":null,"published_at":"2026-05-22T02:16:34+00:00","modified_at":"2026-07-23T16:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}