CVE-2026-34908

CVSS 10 CRITICALEPSS 2.5%● KEVCWE-284

In short

An attacker on the network can bypass security controls in UniFi OS devices to make unauthorized changes to the system. This is a critical flaw because it allows complete compromise of the device without requiring special credentials.

Technical detail

CWE-284 (Improper Access Control) in UniFi OS allows network-adjacent attackers to modify system configurations without proper authorization checks. The vulnerability requires network access but no authentication, enabling arbitrary system modifications with full impact on confidentiality, integrity, and availability.

Summary generated and translated by AI from the official description.

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

public PoCs found — 1

githubgithub.com/BishopFox/CVE-2026-34908-check★ 60

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908 https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/