CVE-2026-34908, CVE-2026-34909, CVE-2026-34910: Ubiquiti UniFi OS ...

CVE-2026-34910 is an improper input validation flaw (CWE-20) in Ubiquiti UniFi OS that allows command injection on affected gateways and network video recorders. A malicious actor with network access to the device can send crafted, unvalidated input that triggers arbitrary command execution, with no privileges or user interaction required (CVSS 3.1 base score 10.0, network vector, scope changed). Successful exploitation grants full control of the device — high confidentiality, integrity, and availability impact — and can serve as a foothold into the attached network. Affected products span the UniFi gateway and recording line: UniFi OS Server, Cloud Gateway Industrial, Dream Machine/Pro/Special Edition/Pro Max, Enterprise Fortress Gateway, Dream Wall, Dream Router and Dream Router 7, UniFi Express 7, and the UniFi Network Video Recorder. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-23, public reporting describes in-the-wild exploitation being used to build a Mirai botnet, and EPSS estimates an 87.5% chance of exploitation within 30 days.

Do: Upgrade all listed UniFi OS devices to the fixed firmware in Ubiquiti's June 2026 security advisory (consult the vendor advisory for exact fixed versions per product), and per CISA BOD 26-04 patch within the required window or discontinue use of affected cloud-reachable assets. Restrict device management interfaces (UniFi Network UI, SSH, API) to trusted networks and audit internet-facing gateways for signs of compromise, including Mirai botnet traffic or unexpected outbound connections.