CVE-2026-34908: Ubiquiti Networks UniFi OS Server access control ...
Found by web discovery while looking for coverage of CVE-2026-34908
CVE-2026-34908, a CVSS 10.0 access-control bypass in Ubiquiti UniFi OS, was added to CISA's KEV catalog amid reported active exploitation.
CISA added CVE-2026-34908 to the Known Exploited Vulnerabilities catalog on June 23, 2026, with remediation due June 26 under BOD 26-04 guidance. The CVSS 10.0 improper access control flaw (CWE-284) in Ubiquiti UniFi OS allows unauthorized system changes without authentication. Multiple news reports referenced by the page describe the max-severity UniFi flaws being exploited in attacks, and an official patch is available.
- Added to CISA KEV June 23, 2026; remediation due June 26
- CVSS 10.0 CWE-284 flaw allows unauthorized UniFi OS configuration changes
- Multiple outlets reported max-severity UniFi flaws exploited in attacks
- Official patch available; BOD 26-04 guidance applies to federal stakeholders
- CVEs
- CVE-2026-34908
- Products
- UniFi OS
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-34908 | Improper Access Control in Ubiquiti UniFi OS Devices (CVE-2026-34908) | 10.0 | 88% | KEVPoC | KEV |
From the original article
2 min read at cve.tools
CVE-2026-34908 is a UniFi OS server and controller security bug that lets an attacker on the network bypass protections and make unauthorized admin-level changes—this should be treated as a serious risk for small businesses using these devices.
By Pavel Buchnev · cve.tools
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.