CVE-2026-34909

Ubiquiti UniFi OS Path Traversal Vulnerability

Ubiquiti UniFi OSNetwork & edge

CVSS

10.0Critical

ExploitationExploited in the wildAdded to KEV 23 Jun 2026CISA KEV

Exploit odds (EPSS)1.79%Chance of exploitation activity in the next 30 days, higher than 78% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in5.0.8Also 4.0.14, 5.1.12 and 2 moreCVE List

Federal deadline26 Jun 2026Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV

What fixes it

5.0.8UniFi OS ServerCVE List
4.0.14ExpressCVE List
5.1.12UDMCVE List
5.1.12UDM-ProCVE List
5.1.12UDM-SECVE List
5.1.12UDM-Pro-MaxCVE List

Show all 32 fixed versions

5.1.11UDM-BeastCVE List
5.1.12EFGCVE List
5.1.12UDWCVE List
5.1.12UDRCVE List
5.1.12UDR7CVE List
5.1.12UDR-5GCVE List
5.1.12Express 7CVE List
5.1.12UNVRCVE List
5.1.12UNVR-ProCVE List
5.1.12UNVR-InstantCVE List
5.1.12UNVR-G2CVE List
5.1.12UNVR-G2-ProCVE List
5.1.12ENVRCVE List
5.1.12ENVR-CoreCVE List
5.1.10UNAS-2CVE List
5.1.10UNAS-4CVE List
5.1.10UNAS-ProCVE List
5.1.10UNAS-Pro-4CVE List
5.1.10UNAS-Pro-8CVE List
5.1.12UCKPCVE List
5.1.12UCKCVE List
5.1.12UCK-EnterpriseCVE List
5.1.12UCG-UltraCVE List
5.1.12UCG-MaxCVE List
5.1.12UCG-FiberCVE List
5.1.12UCG-IndustrialCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

22 May 2026, 00:43 UTCPublishedCVE List
23 Jun 2026Added to CISA KEVCISA KEV

Description

Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.

Text from CVE List

Affected versions 32

UniFi OS Serveraffected: all versions before 5.0.8CVE List
Expressaffected: all versions before 4.0.14CVE List
UDMaffected: all versions before 5.1.12CVE List
UDM-Proaffected: all versions before 5.1.12CVE List
UDM-SEaffected: all versions before 5.1.12CVE List
UDM-Pro-Maxaffected: all versions before 5.1.12CVE List
UDM-Beastaffected: all versions before 5.1.11CVE List
EFGaffected: all versions before 5.1.12CVE List
UDWaffected: all versions before 5.1.12CVE List
UDRaffected: all versions before 5.1.12CVE List
UDR7affected: all versions before 5.1.12CVE List
UDR-5Gaffected: all versions before 5.1.12CVE List
Express 7affected: all versions before 5.1.12CVE List
UNVRaffected: all versions before 5.1.12CVE List
UNVR-Proaffected: all versions before 5.1.12CVE List
UNVR-Instantaffected: all versions before 5.1.12CVE List
UNVR-G2affected: all versions before 5.1.12CVE List
UNVR-G2-Proaffected: all versions before 5.1.12CVE List
ENVRaffected: all versions before 5.1.12CVE List
ENVR-Coreaffected: all versions before 5.1.12CVE List
UNAS-2affected: all versions before 5.1.10CVE List
UNAS-4affected: all versions before 5.1.10CVE List
UNAS-Proaffected: all versions before 5.1.10CVE List
UNAS-Pro-4affected: all versions before 5.1.10CVE List
UNAS-Pro-8affected: all versions before 5.1.10CVE List
UCKPaffected: all versions before 5.1.12CVE List
UCKaffected: all versions before 5.1.12CVE List
UCK-Enterpriseaffected: all versions before 5.1.12CVE List
UCG-Ultraaffected: all versions before 5.1.12CVE List
UCG-Maxaffected: all versions before 5.1.12CVE List
UCG-Fiberaffected: all versions before 5.1.12CVE List
UCG-Industrialaffected: all versions before 5.1.12CVE List