CVE-2026-34908

CVE-2026-34908 is an improper access control flaw (CWE-284) in Ubiquiti UniFi OS, the operating system running on UniFi gateways, Dream Machine appliances, and UniFi network video recorders. An attacker who can reach the device over the network — with no privileges or user interaction required per the CVSS vector — can make unauthorized changes to the system. The CVSS 3.1 score of 10.0 with a changed scope (S:C) indicates a successful attack can compromise the device beyond its intended security boundary, with high impact to confidentiality, integrity, and availability. Any organization running the affected UniFi OS products, including UniFi OS Server and the Dream Machine, Cloud Gateway, Enterprise Fortress, Dream Router, Express, and UNVR lines, is affected; specific vulnerable and fixed firmware versions are not specified in the available data. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-23, confirming active exploitation, and EPSS assigns an 85.2% probability of exploitation within 30 days (100th percentile); ransomware use is unknown.

What to do: Apply the patched UniFi OS firmware from Ubiquiti's advisory immediately (exact fixed versions are not given in this data) and review affected consoles for unauthorized configuration changes, as the KEV listing requires action under CISA BOD 26-04. Restrict UniFi OS management interfaces and SSH from internet exposure, and isolate or discontinue use of any device that cannot be patched. The same release addresses sibling UniFi OS flaws CVE-2026-34909 and CVE-2026-34910, with CVE-2026-34910 reported exploited in the wild to build a Mirai botnet, so patching covers the full batch.