CVE-2026-34908

critical

Description

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

References

https://thehackernews.com/2026/07/ubiquiti-patches-critical-unifi-flaws.html

https://securityaffairs.com/194978/security/ubiquiti-patches-critical-unifi-os-flaws-allowing-command-injection-and-privilege-escalation.html

https://www.securityweek.com/critical-ubiquiti-vulnerabilities-in-attackers-crosshairs/

https://www.bleepingcomputer.com/news/security/cisa-warns-of-max-severity-ubiquiti-flaws-exploited-in-attacks/

https://thehackernews.com/2026/06/cisa-warns-critical-lantronix-eds5000.html

https://securityaffairs.com/194142/security/u-s-cisa-adds-ubiquiti-unifi-os-and-lantronix-eds5000-plugin-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2026/06/23/cisa-adds-four-known-exploited-vulnerabilities-catalog

https://www.bleepingcomputer.com/news/security/critical-unifi-os-bug-lets-hackers-gain-root-without-authentication/

https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-unifi-os-vulnerabilities/

https://github.com/Boreas37/CVE-2026-34910-PoC

https://github.com/Byungju/cve-research-lab

https://github.com/BishopFox/CVE-2026-34908-check

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908

https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b

Details

Source: Mitre, NVD

Published: 2026-05-22

Updated: 2026-07-23

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 10

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H