CVE-2026-34908

Ubiquiti UniFi OS Improper Access Control Vulnerability

Ubiquiti UniFi OSNetwork & edge

CVSS

10.0Critical

ExploitationExploited in the wildAdded to KEV 23 Jun 2026CISA KEV

Exploit odds (EPSS)15.2%Chance of exploitation activity in the next 30 days, higher than 96% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in5.0.8Also 5.1.12, 5.1.11 and 1 moreCVE List

Federal deadline26 Jun 2026Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV

What fixes it

5.0.8UniFi OS ServerCVE List
5.1.12UDMCVE List
5.1.12UDM-ProCVE List
5.1.12UDM-SECVE List
5.1.12UDM-Pro-MaxCVE List
5.1.11UDM-BeastCVE List

Show all 31 fixed versions

5.1.12EFGCVE List
5.1.12UDWCVE List
5.1.12UDRCVE List
5.1.12UDR7CVE List
5.1.12UDR-5GCVE List
5.1.12Express 7CVE List
5.1.12UNVRCVE List
5.1.12UNVR-ProCVE List
5.1.12UNVR-InstantCVE List
5.1.12UNVR-G2CVE List
5.1.12UNVR-G2-ProCVE List
5.1.12ENVRCVE List
5.1.12ENVR-CoreCVE List
5.1.10UNAS-2CVE List
5.1.10UNAS-4CVE List
5.1.10UNAS-ProCVE List
5.1.10UNAS-Pro-4CVE List
5.1.10UNAS-Pro-8CVE List
5.1.12UCKPCVE List
5.1.12UCKCVE List
5.1.12UCK-EnterpriseCVE List
5.1.12UCG-UltraCVE List
5.1.12UCG-MaxCVE List
5.1.12UCG-FiberCVE List
5.1.12UCG-IndustrialCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

22 May 2026, 00:43 UTCPublishedCVE List
23 Jun 2026Added to CISA KEVCISA KEV

Public exploit code and templates 1

Scanner templateUniFi OS - Authentication Bypass via Path Traversal (..%2f)Nuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.

Text from CVE List

Affected versions 31

UniFi OS Serveraffected: all versions before 5.0.8CVE List
UDMaffected: all versions before 5.1.12CVE List
UDM-Proaffected: all versions before 5.1.12CVE List
UDM-SEaffected: all versions before 5.1.12CVE List
UDM-Pro-Maxaffected: all versions before 5.1.12CVE List
UDM-Beastaffected: all versions before 5.1.11CVE List
EFGaffected: all versions before 5.1.12CVE List
UDWaffected: all versions before 5.1.12CVE List
UDRaffected: all versions before 5.1.12CVE List
UDR7affected: all versions before 5.1.12CVE List
UDR-5Gaffected: all versions before 5.1.12CVE List
Express 7affected: all versions before 5.1.12CVE List
UNVRaffected: all versions before 5.1.12CVE List
UNVR-Proaffected: all versions before 5.1.12CVE List
UNVR-Instantaffected: all versions before 5.1.12CVE List
UNVR-G2affected: all versions before 5.1.12CVE List
UNVR-G2-Proaffected: all versions before 5.1.12CVE List
ENVRaffected: all versions before 5.1.12CVE List
ENVR-Coreaffected: all versions before 5.1.12CVE List
UNAS-2affected: all versions before 5.1.10CVE List
UNAS-4affected: all versions before 5.1.10CVE List
UNAS-Proaffected: all versions before 5.1.10CVE List
UNAS-Pro-4affected: all versions before 5.1.10CVE List
UNAS-Pro-8affected: all versions before 5.1.10CVE List
UCKPaffected: all versions before 5.1.12CVE List
UCKaffected: all versions before 5.1.12CVE List
UCK-Enterpriseaffected: all versions before 5.1.12CVE List
UCG-Ultraaffected: all versions before 5.1.12CVE List
UCG-Maxaffected: all versions before 5.1.12CVE List
UCG-Fiberaffected: all versions before 5.1.12CVE List
UCG-Industrialaffected: all versions before 5.1.12CVE List