CVE-2026-34908, CVE-2026-34909, CVE-2026-34910: Ubiquiti UniFi OS ...
Found by web discovery while looking for coverage of CVE-2026-34908
Ubiquiti UniFi OS flaws CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 were added to CISA's KEV, chaining auth bypass into command injection.
Ubiquiti UniFi OS vulnerabilities CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 were added to CISA's KEV catalog. CVE-2026-34908 (CVSS 10.0, CWE-284) is an unauthenticated improper access control flaw allowing unauthorized system changes, described as the initial entry point. It enables attackers to then leverage chained path traversal and command injection flaws for deeper compromise.
- Three UniFi OS CVEs added to CISA's KEV catalog
- CVE-2026-34908 serves as unauthenticated initial entry point
- Chained into path traversal and command injection for deeper compromise
- Products
- UniFi OS
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-34910+2 related CVEs | Unauthenticated Command Injection in Ubiquiti UniFi OS Devices | 10.0 | 90% | KEVPoC | KEV |
From the original article
CVE-2026-34908 (CVSS 10. 0, CWE-284): An improper access control flaw allows unauthorized changes to the system without authentication. This is the initial entry point that bypasses all access controls, enabling the attacker to then leverage the path traversal and command injection.
threat-modeling.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.