CVE-2026-34908: CVSS 10.0 Ubiquiti UniFi OS access-control bypass added to CISA KEV catalog
CVE-2026-34908 is a CVSS 3.1 10.0 improper access-control flaw (CWE-284) in Ubiquiti UniFi OS that lets unauthenticated network-adjacent attackers modify device configuration without credentials. CISA added it to the Known Exploited Vulnerabilities catalog on…
Ubiquiti disclosed CVE-2026-34908 in UI Security Advisory Bulletin 064 as an improper access-control vulnerability (CWE-284) affecting UniFi OS gateways and consoles, with a CVSS 3.1 base score of 10.0. An unauthenticated, network-adjacent attacker can bypass access controls and modify system configuration with no privileges or user interaction required, with scope-changed impact on downstream network services such as routing, VPN, and connected access points. CISA added the vulnerability to the KEV catalog on June 23, 2026, with remediation due June 26 under BOD 26-04 guidance for federal stakeholders; multiple news outlets referenced in the reports described the max-severity UniFi flaws being exploited in attacks. Both reports agree on the CVE id, CWE-284 classification, CVSS 10.0 score, and that the attacker needs no authentication (Report 2's headline calls it an 'authentication bypass' while the advisory detail classifies it as improper access control; both state no credentials are required). Fixed firmware is available per both sources. Interim workarounds include restricting management ports to trusted subnets, isolating management interfaces on a dedicated VLAN, and disabling remote access features. No public proof-of-concept code was observed at the time of the second report's publication (2026-09-08).
- CVE: CVE-2026-34908, affecting Ubiquiti Networks UniFi OS gateways and consoles
- Classified as CWE-284 improper access control with CVSS 3.1 base score 10.0
- Disclosed in UI Security Advisory Bulletin 064; fixed firmware available per both reports
- Unauthenticated, network-adjacent attack vector; no privileges or user interaction required
- Scope-changed impact on downstream network services including routing, VPN, and connected access points
- Added to CISA KEV catalog June 23, 2026; remediation due June 26, 2026 under BOD 26-04 guidance for federal stakeholders
- Multiple news outlets reported the max-severity UniFi flaws being exploited in attacks
- Workarounds: restrict management ports to trusted subnets, isolate management interface on a dedicated VLAN, disable remote access features
Coverage timelineoldest first · each row is one article
- · 8d agoCVE-2026-34908: Ubiquiti Networks UniFi OS Server access control ...
Web discovery (articles for new exploits & KEV entries)· 68
CVE-2026-34908, a CVSS 10.0 access-control bypass in Ubiquiti UniFi OS, was added to CISA's KEV catalog amid reported active exploitation.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-34908 | Improper Access Control in Ubiquiti UniFi OS Devices (CVE-2026-34908) CVE-2026-34908 is an improper access control flaw (CWE-284) in Ubiquiti UniFi OS, the operating system running on UniFi gateways, Dream Machine appliances, and UniFi network video recorders. An attacker who can reach the device over the network — with no privileges or user interaction required per the CVSS vector — can make unauthorized changes to the system. The CVSS 3.1 score of 10.0 with a changed scope (S:C) indicates a successful attack can compromise the device beyond its intended security boundary, with high impact to confidentiality, integrity, and availability. Any organization running the affected UniFi OS products, including UniFi OS Server and the Dream Machine, Cloud Gateway, Enterprise Fortress, Dream Router, Express, and UNVR lines, is affected; specific vulnerable and fixed firmware versions are not specified in the available data. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-23, confirming active exploitation, and EPSS assigns an 85.2% probability of exploitation within 30 days (100th percentile); ransomware use is unknown. Do: Apply the patched UniFi OS firmware from Ubiquiti's advisory immediately (exact fixed versions are not given in this data) and review affected consoles for unauthorized configuration changes, as the KEV listing requires action under CISA BOD 26-04. Restrict UniFi OS management interfaces and SSH from internet exposure, and isolate or discontinue use of any device that cannot be patched. The same release addresses sibling UniFi OS flaws CVE-2026-34909 and CVE-2026-34910, with CVE-2026-34910 reported exploited in the wild to build a Mirai botnet, so patching covers the full batch. | 10.0 | 85% | KEV PoC |
| masson the order of 1M+ deployed UniFi OS consoles/gateways, with 100k+ internet-exposed management interfaces |