CVE-2026-34909

A path traversal flaw (CWE-22) in Ubiquiti UniFi OS, carrying a maximum CVSS 3.1 score of 10.0, allows a malicious actor with network access to send crafted requests that traverse directories and read arbitrary files on the underlying system. Files retrieved this way can be manipulated to gain access to an underlying account, and the CVSS vector's scope-changed, high-impact ratings indicate the resulting compromise can extend beyond the vulnerable component. Any environment running the affected UniFi OS devices is at risk, spanning UniFi OS Server and the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Fortress Gateway, UniFi Express 7, and UniFi Network Video Recorder firmware families. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-06-23, confirming exploitation in the wild, and EPSS assigns a 63.9% probability of exploitation within 30 days (99th percentile). It was patched by Ubiquiti in June 2026 alongside related UniFi OS issues CVE-2026-34908 and CVE-2026-34910.

What to do: Update UniFi OS and device firmware to the latest releases per Ubiquiti's June 2026 advisory (issued alongside fixes for CVE-2026-34908 and CVE-2026-34910), prioritizing internet-exposed consoles in line with CISA BOD 26-04 timelines. Until patched, restrict UniFi management interfaces (web UI and SSH) from the internet and limit network access to trusted clients. Review device logs and consider rotating exposed management credentials, since path traversal can be used to reach underlying account material.