CVE-2026-34908: UniFi OS Auth Bypass Vulnerability
Found by web discovery while looking for coverage of CVE-2026-34908
Ubiquiti disclosed CVE-2026-34908, a CVSS 10.0 authentication bypass in UniFi OS letting network-adjacent attackers alter device configuration without credentials.
CVE-2026-34908 is an improper access control flaw (CWE-284) in Ubiquiti UniFi OS devices, disclosed in UI Security Advisory Bulletin 064, with a CVSS 3.1 base score of 10.0. An unauthenticated network-adjacent attacker can bypass access controls and modify system configuration, with scope-changed impact on downstream network services such as routing, VPN, and connected access points. Fixed firmware is available, and workarounds include restricting management ports to trusted subnets, isolating management interfaces on a dedicated VLAN, and disabling remote access features. No public proof-of-concept code was observed at the time of publication.
- CVSS 10.0 unauthenticated access-control bypass on UniFi OS gateways and consoles
- Disclosed in UI Security Advisory Bulletin 064; fixed firmware available
- No privileges or user interaction required; network-adjacent attack vector
- Workarounds: restrict management ports, isolate on VLAN, disable remote access
- CVEs
- CVE-2026-34908
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-34908 | Improper Access Control in Ubiquiti UniFi OS Devices (CVE-2026-34908) | 10.0 | 88% | KEVPoC | KEV |
From the original article
3 min read at sentinelone.com
CVE-2026-34908 is an authentication bypass vulnerability in UniFi OS devices. Learn about its impact, affected versions, and mitigation methods.
sentinelone.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.