Unauthenticated Path Traversal in Ubiquiti UniFi OS Devices
CISA: Ubiquiti UniFi OS Path Traversal Vulnerability
CVSS 3.1
10.0critical
EPSS
65%p99
Published
()
KEV added
AI analysis
A path traversal flaw (CWE-22) in Ubiquiti UniFi OS, carrying a maximum CVSS 3.1 score of 10.0, allows a malicious actor with network access to send crafted requests that traverse directories and read arbitrary files on the underlying system. Files retrieved this way can be manipulated to gain access to an underlying account, and the CVSS vector's scope-changed, high-impact ratings indicate the resulting compromise can extend beyond the vulnerable component. Any environment running the affected UniFi OS devices is at risk, spanning UniFi OS Server and the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Fortress Gateway, UniFi Express 7, and UniFi Network Video Recorder firmware families. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-06-23, confirming exploitation in the wild, and EPSS assigns a 63.9% probability of exploitation within 30 days (99th percentile). It was patched by Ubiquiti in June 2026 alongside related UniFi OS issues CVE-2026-34908 and CVE-2026-34910.
What to do: Update UniFi OS and device firmware to the latest releases per Ubiquiti's June 2026 advisory (issued alongside fixes for CVE-2026-34908 and CVE-2026-34910), prioritizing internet-exposed consoles in line with CISA BOD 26-04 timelines. Until patched, restrict UniFi management interfaces (web UI and SSH) from the internet and limit network access to trusted clients. Review device logs and consider rotating exposed management credentials, since path traversal can be used to reach underlying account material.
Affected
Ubiquiti UniFi OS Server
—
Ubiquiti UniFi Cloud Gateway Industrial firmware
—
Ubiquiti UniFi Dream Machine firmware
—
Ubiquiti UniFi Dream Machine Pro firmware
—
Ubiquiti UniFi Dream Machine Special Edition firmware
—
Ubiquiti UniFi Dream Machine Pro Max firmware
—
Ubiquiti Enterprise Fortress Gateway firmware
—
Ubiquiti UniFi Dream Wall firmware
—
Ubiquiti UniFi Dream Router firmware
—
Ubiquiti UniFi Dream Router 7 firmware
—
Ubiquiti UniFi Express 7 firmware
—
Ubiquiti UniFi Network Video Recorder firmware
—
Estimated exposure
massMillions of installed UniFi OS devices/sites, with likely 100k+ consoles internet-exposed — Ubiquiti's UniFi gateway/recorder line is one of the most widely deployed SMB and prosumer networking platforms, with a multi-million-device installed base, and public internet scans routinely surface hundreds of thousands of exposed UniFi…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.
CISA Known Exploited Vulnerability
Affected
Ubiquiti UniFi OS
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ubiquiti UniFi OS flaws CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 were added to CISA's KEV, chaining auth bypass into command injection.
Ubiquiti UniFi OS vulnerabilities CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 were added to CISA's KEV catalog. CVE-2026-34908 (CVSS 10.0, CWE-284) is an unauthenticated improper access control flaw allowing unauthorized system changes, described as the initial entry point. It enables attackers to then leverage chained path traversal and command injection flaws for deeper compromise.