CVE-2026-34909

CVSS 10 CRITICALEPSS 2.3%● KEVCWE-22

In short

A network attacker can use a path traversal flaw in UniFi OS to access and modify system files, potentially gaining control of user accounts on the device.

Technical detail

Path traversal vulnerability (CWE-22) in UniFi OS allows an attacker with network access to bypass directory restrictions and read/write arbitrary system files; exploitation could lead to privilege escalation or account takeover by manipulating authentication-related files.

Summary generated and translated by AI from the official description.

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34909 https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/