{"id":"CVE-2026-34910","kind":"vulnerability","aliases":["CVE-2026-34910"],"related":[],"title":"A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi…","description":"Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Ubiquiti UniFi OS contains an improper input validation flaw that lets a malicious actor with network access inject commands. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-06-23T00:00:00+00:00","products":[{"name":"Ubiquiti UniFi OS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ui unifi os server","fixed":["5.0.8"],"affected":"< 5.0.8","ecosystem":"vendor"},{"name":"ui unifi cloud gateway industrial firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine pro firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine special edition firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine pro max firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui enterprise fortress gateway firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream wall firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream router firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream router 7 firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi express 7 firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder pro firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder instant firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui enterprise network video recorder firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloud gateway ultra firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloud gateway max firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloud gateway fiber firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream router 5g max firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui enterprise network video recorder core firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloud key plus firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloudkey firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi cloudkey enterprise firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder g2 firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi network video recorder g2 pro firmware","fixed":["5.1.12"],"affected":"< 5.1.12","ecosystem":"vendor"},{"name":"ui unifi dream machine beast firmware","fixed":["5.1.11"],"affected":"< 5.1.11","ecosystem":"vendor"},{"name":"ui unas 2 firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unas 4 firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unas pro firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unas pro 4 firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"},{"name":"ui unas pro 8 firmware","fixed":["5.1.10"],"affected":"< 5.1.10","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","network-appliance","self-hosted","ubiquiti","unifi-os","vendor"],"not_affected_if":["no-unifi-os-devices"],"how_to_check":null,"fix":"Apply the vendor's mitigations and updates for UniFi OS; the sources do not name the fixed version. Follow CISA BOD 26-04 guidance and discontinue use if mitigations are unavailable.","status":"open","published_at":"2026-05-22T02:16:34+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:49+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:33:49Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor's mitigations and updates for UniFi OS; the sources do not name the fixed version. Follow CISA BOD 26-04 guidance and discontinue use if mitigations are unavailable.","summary":"Ubiquiti UniFi OS contains an improper input validation flaw that lets a malicious actor with network access inject commands. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["unifi-os","ubiquiti","self-hosted","network-appliance"],"confidence":0.6,"analyst_note":"Find the affected and fixed UniFi OS versions and the vendor advisory for CVE-2026-34910 (Ubiquiti security advisories, CISA KEV entry).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-unifi-os-devices"],"severity_if_unknown":"high"},"cost_usd":0.000376,"input_tokens":2203,"output_tokens":311,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':286C,312C,343C '-2026':20A,23A '-34910':21A,24A '2':185A '26':285C,311C,342C '4':189A,198A '5g':137A '7':82A,87A '8':203A 'access':5A,233B,261C 'accord':275C 'action':271C 'activ':240B 'actor':3A,230B,259C 'adher':339C 'allow':256C 'appli':272C 'applianc':208B 'applic':309C 'asset':333C 'base':290C 'beast':181A 'bod':284C,310C,341C 'cisa':236B,269C,282C,299C 'cloud':34A,117A,123A,129A,149A,315C 'cloudkey':155A,159A 'command':235B,267C 'complianc':280C 'conduct':266C 'contain':220B,248C 'core':145A 'could':9A,255C 'cve':19A,22A 'discontinu':318C 'dream':40A,45A,51A,58A,70A,75A,80A,135A,179A 'edition':54A 'ensur':279C,338C 'enterprise':64A,110A,141A,160A 'evalu':331C 'exploit':10A,205B,241B 'exposur':336C 'express':86A 'fiber':131A 'firmware':37A,42A,48A,55A,62A,67A,72A,77A,83A,88A,94A,101A,108A,114A,120A,126A,132A,139A,146A,152A,156A,161A,168A,176A,182A,186A,190A,194A,199A,204A 'flaw':225B 'follow':308C 'forens':301C 'fortress':65A 'found':16A 'g2':167A,174A 'gateway':35A,66A,118A,124A,130A 'guidanc':297C,313C 'guidelin':345C 'host':211B 'improp':12A,222B,250C 'industrial':36A 'inject':234B,268C 'input':13A,223B,251C 'instant':107A 'instruct':278C 'internet':335C 'key':150A 'let':227B 'list':237B 'machine':41A,46A,52A,59A,180A 'malici':2A,229B,258C 'max':61A,125A,138A 'mitig':273C,324C 'network':8A,91A,97A,104A,111A,142A,164A,171A,207B,232B,264C 'network-appli':206B 'note':296C,307C 'os':27A,30A,215B,219B,247C 'patch':344C 'plus':151A 'priorit':287C 'pro':47A,60A,100A,175A,193A,197A,202A 'product':322C 'recorder':93A,99A,106A,113A,144A,166A,173A 'requir':270C,303C 'respons':329C 'risk':292C 'router':76A,81A,136A 'secur':288C 'see':293C,304C 'self':210B 'self-host':209B 'server':31A 'servic':316C 'special':53A 'stakehold':327C 'triag':302C 'ubiqu':212B,217B,245C 'ubiquiti':25A 'ui':28A,32A,38A,43A,49A,56A,63A,68A,73A,78A,84A,89A,95A,102A,109A,115A,121A,127A,133A,140A,147A,153A,157A,162A,169A,177A,183A,187A,191A,195A,200A 'ultra':119A 'unas':184A,188A,192A,196A,201A 'unavail':326C 'unifi':18A,26A,29A,33A,39A,44A,50A,57A,69A,74A,79A,85A,90A,96A,103A,116A,122A,128A,134A,148A,154A,158A,163A,170A,178A,214B,218B,246C 'unifi-o':213B 'updat':289C 'url':294C,305C 'use':319C 'valid':14A,224B,252C 'vendor':216B,277C 'video':92A,98A,105A,112A,143A,165A,172A 'vulner':15A,253C 'wall':71A 'wild':244B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-22T02:16:34+00:00","kev":{"dateAdded":"2026-06-23","dueDate":"2026-06-26","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-34910","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34910","severity":null,"published_at":"2026-06-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-34910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34910","severity":null,"published_at":"2026-05-22T02:16:34+00:00","modified_at":"2026-07-23T16:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}