Ubiquiti UniFi OS — Unauthenticated RCE Chain
CVE-2026-34908 / 34909 / 34910 · Auth Bypass → File Traversal → Command Injection → Root

Three CVSS 10.0 vulnerabilities in Ubiquiti UniFi OS — each critical on its own — chain together to give any network-reachable attacker unauthenticated root access on UniFi OS devices. No credentials required. No user interaction required. The chain affects every UniFi OS-powered device: Cloud Gateways, network appliances, Dream Machines, Protect NVRs, Access hubs, and Talk appliances. CISA added all three to the Known Exploited Vulnerabilities catalog on June 23, 2026 with a three-day remediation deadline. Censys identified approximately 100,000 internet-facing UniFi OS endpoints globally, with roughly 50,000 in the United States.

CVE-2026-34908 — CVSS 10.0 — CWE-284 (Improper Access Control)
The authentication gateway NGINX processes crafted requests with a divergence between the raw URI and the normalized URI. A request beginning with an auth-exempt prefix passes the authentication check in raw form, but after normalization routes to an authenticated internal endpoint. This is the bypass that opens the door.

CVE-2026-34909 — CVSS 10.0 — CWE-22 (Path Traversal)
A path traversal in the internal file management handler permits reading and writing arbitrary files on the underlying UniFi OS host, including sensitive configuration files, signing keys, and credential stores. Used together with the auth bypass, this is exploitable without authentication.

CVE-2026-34910 — CVSS 10.0 — CWE-20 (Improper Input Validation)
The package-update service passes a user-supplied package name directly to a shell command without validation. Combined with the auth bypass, this enables arbitrary OS command injection against the service account running package updates — which holds passwordless sudo privileges over dpkg, chmod, and systemctl, making privilege escalation to root trivial via a malicious .deb package.

CISA KEV: All three added June 23, 2026. Deadline June 26, 2026 (BOD 26-04)
Patch: UniFi OS Server 5.0.8 (released May 21, 2026)
Affected: UniFi OS Server 5.0.6 and earlier (all hardware running UniFi OS)

BishopFox researchers documented and published the full exploit chain. The attack proceeds as follows:

Step 1 — Auth bypass (34908 + 34909): The attacker sends a request with a URI that passes the authentication exemption check in raw form. NGINX normalizes the path before routing, and the normalized form reaches an authenticated internal API endpoint. The authentication check has already passed and is not re-evaluated on the normalized path. The attacker is now inside the authenticated surface.

Step 2 — Command injection (34910): The attacker accesses the package-update service endpoint through the bypass. This endpoint accepts a package name and passes it to a shell command. No validation is performed on the package name. The attacker injects a command. The service account executing the update holds passwordless sudo privileges over dpkg, chmod, and systemctl.

Step 3 — Root escalation: Using the sudo access, the attacker installs a crafted .deb package or executes privileged commands directly. Full root on the UniFi OS host. From root, the attacker can read the UniFi secret store (signing keys, TLS certificates, cloud tokens, login database, network configuration), create persistent backdoors, and pivot through connected network infrastructure.

Active exploitation has been observed creating rogue administrator accounts named "John Sim" during automated reconnaissance sweeps — a reliable indicator of compromise when found in UniFi controller logs.

UniFi is the dominant networking platform for small and mid-sized organizations — it controls gateways, switches, wireless APs, cameras, physical access panels, and VoIP across hundreds of thousands of deployments. Many of these consoles are internet-accessible because administrators use Ubiquiti's remote management features or expose the management port directly. Censys tracked approximately 100,000 internet-facing instances globally. At patch release on May 21, 2026, zero-day exploitation had not been publicly confirmed. By June 23 when CISA added all three to KEV, active exploitation was confirmed in the wild.

— CISA KEV Catalog — CVE-2026-34908, 34909, 34910
— BishopFox — Safe Detection Tool (GitHub)
— SecurityWeek — Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs
— Beazley Security — UniFi OS RCE Chain Advisory
— NVD — CVE-2026-34908
— MITRE ATT&CK — T1190 Exploit Public-Facing Application