ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “UniFi OS”

6 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 72Malware 34Industry 29Exploit / PoC 28Ransomware 26Policy & legal 19Data breach 10Advisory 4AI industry 4AI safety & security 4Threat actor 3Tools 3Phishing & fraud 2Model release 1
SeverityAllcritical 113high 46medium 39low 14info 29

CVE-2026-34908: Ubiquiti Networks UniFi OS Server access control ...

CVE-2026-34908, a CVSS 10.0 access-control bypass in Ubiquiti UniFi OS, was added to CISA's KEV catalog amid reported active exploitation.

CISA added CVE-2026-34908 to the Known Exploited Vulnerabilities catalog on June 23, 2026, with remediation due June 26 under BOD 26-04 guidance. The CVSS 10.0 improper access control flaw (CWE-284) in Ubiquiti UniFi OS allows unauthorized system changes without authentication. Multiple news reports referenced by the page describe the max-severity UniFi flaws being exploited in attacks, and an official patch is available.

Web discovery (articles for new exploits & KEV entries) · 8d agoExploit / PoC in the wildCVE-2026-34908

CVE-2026-34908, CVE-2026-34909, CVE-2026-34910: Ubiquiti UniFi OS ...

Ubiquiti UniFi OS flaws CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 were added to CISA's KEV, chaining auth bypass into command injection.

Ubiquiti UniFi OS vulnerabilities CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 were added to CISA's KEV catalog. CVE-2026-34908 (CVSS 10.0, CWE-284) is an unauthenticated improper access control flaw allowing unauthorized system changes, described as the initial entry point. It enables attackers to then leverage chained path traversal and command injection flaws for deeper compromise.

Web discovery (articles for new exploits & KEV entries) · 15d agoExploit / PoC in the wildCVE-2026-34908CVE-2026-34909CVE-2026-34910

Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

Attackers actively exploit CVE-2026-89026, a hard-coded JWT key flaw enabling unauthenticated OS command execution on Issabel PBX systems.

VulnCheck reported active exploitation of CVE-2026-89026 (CVSS v3.1 9.8) in Issabel Framework, the web framework for the open-source Issabel unified communications PBX. A hard-coded HS256 JWT signing key identical across every installation lets unauthenticated attackers forge bearer tokens and abuse the /pbxapi/manager/originate endpoint, causing Asterisk to execute arbitrary OS commands as the Asterisk user. A patch replacing the hard-coded key with one stored in /etc/issabel.conf shipped August 1, 2026, and the Shadowserver Foundation first observed exploitation on September 9, 2026. Details on real-world abuse, attribution, and scale remain unknown.

The Hacker News · 2h agoExploit / PoC in the wild 2 sourcesCVE-2026-89026

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.

Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.

Wiz Blog · 7d agoExploit / PoC in the wildCVE-2026-59822CVE-2026-598211