Ubiquiti UniFi OS — Three Max-Severity Pre-Auth Vulnerabilities (CVE-2026-34908 / 34909 / 34910) in Security Advisory Bulletin 064

Ubiquiti UniFi OS (TL-2026-0563), also tracked as Ubiquiti Security Advisory Bulletin 064, is a critical-severity software vulnerability scored CVSS 10, first published 2026-05-22. It has no confirmed attribution, affects Ubiquiti UniFi OS (UniFi Cloud Gateways, Dream Machines, Cloud Keys, references 5 CVEs (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910), maps to 26 MITRE ATT&CK techniques (T1003, T1040, T1041), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-0563

Threat ID
TL-2026-0563
Also known as
Ubiquiti Security Advisory Bulletin 064, UniFi OS Triple-10 Cluster, UniFi OS May 2026 Pre-Auth RCE Chain
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-05-22
Last reviewed
2026-05-22
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
small-and-medium-business, managed-service-providers, consumer-residential, education, hospitality, retail, healthcare, regional-isp, remote-site-and-branch-office, government-local-and-state
Target regions
North America, Europe, United Kingdom, Australia, Japan, Brazil, Global
Detection rules
9
Indicators of compromise
20

Ubiquiti's Security Advisory Bulletin 064 (2026-05-22) patches five UniFi OS flaws, three of which are CVSS 10.0 and pre-authentication: CVE-2026-34908 (Improper Access Control), CVE-2026-34909 (Path Traversal), and CVE-2026-34910 (Command Injection via Improper Input Validation). The cluster also includes CVE-2026-33000 (post-auth command injection) and CVE-2026-34911 (information disclosure). Censys tracks ~100,000 internet-exposed UniFi OS endpoints (~50,000 in the United States), producing one of the largest immediate pre-auth attack surfaces of 2026; fixes ship in UniFi OS 5.1.12 and UniFi OS Server 5.0.8.

How Ubiquiti UniFi OS works

On 2026-05-22, Ubiquiti published Security Advisory Bulletin 064 addressing five vulnerabilities in UniFi OS, the unified operating system that powers UniFi Cloud Gateways, UniFi Dream Machines, UniFi Express, and the UniFi OS Server (Linux/Windows/macOS) variant. Three of the five flaws — CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 — carry the maximum CVSS v3.1 base score of 10.0 and are exploitable without authentication over the network. All five were reported through Ubiquiti's HackerOne bug bounty program and were patched in UniFi OS 5.1.12 and UniFi OS Server 5.0.8.

CVE-2026-34908 is an Improper Access Control (CWE-284) defect that permits a remote unauthenticated attacker to make unauthorized changes to the configuration and state of an affected UniFi OS console. Because UniFi OS exposes management surfaces (HTTPS on TCP/443, the UniFi Network UI on TCP/8443, and the UniFi Inform channel on TCP/8080) by default on cloud-gateway products, an attacker who can reach any of these ports can drive privileged state transitions without supplying credentials. The flaw is the foundation of the most severe exploit chain because it allows the unauthenticated caller to invoke functionality previously restricted to administrators — notably the device-management, backup-restore, and update-orchestration endpoints.

CVE-2026-34909 is a Path Traversal (CWE-22) vulnerability that lets the same unauthenticated network attacker step outside the intended file scope and read arbitrary files from the underlying Linux root filesystem. Ubiquiti's own description states the flaw can be manipulated to 'access an underlying account', which in practice means reading the cleartext or hashed credential material the UniFi OS stack stores on disk (administrator account files under /data/unifi-core/config, SQLite databases under /data/unifi/db, and SSH host keys under /etc/ssh). Once an attacker reads these artifacts they can either authenticate to the appliance directly or crack the stored hash offline, transforming a read-only file disclosure into full account takeover.

CVE-2026-34910 is an Improper Input Validation defect (CWE-78 OS Command Injection) reachable after the attacker has 'gained network access' to UniFi OS — meaning the attacker can supply attacker-controlled command fragments to a request handler that ultimately invokes a shell, system(), or popen() with insufficient sanitization. Concatenating CVE-2026-34908 (bypass of the auth gate), CVE-2026-34909 (read of secrets from disk), and CVE-2026-34910 (arbitrary command execution as the unifi service user) yields a complete remote, unauthenticated root-equivalent RCE chain on the appliance. Because UniFi OS runs as root on most cloud-gateway hardware and the unifi-core service has effective sudo privileges, post-exploitation provides device-takeover capability suitable for botnet recruitment, persistent residential/SMB proxy networks, or pivoting into the LAN segment the appliance routes.

CVE-2026-33000 is a second OS command injection that requires authentication and is rated Critical; it is most useful as a privilege-escalation primitive after credentials are obtained, but is also exploitable directly by any legitimate UniFi OS user. CVE-2026-34911 is a high-severity Information Disclosure that leaks system metadata which is useful for fingerprinting affected versions and selecting payloads — the natural reconnaissance partner for the pre-auth chain above.

Exposure data from Censys (cited by BleepingComputer) shows roughly 100,000 UniFi OS management surfaces reachable from the public internet, with approximately half (~50,000 IPs) located in the United States. The remaining endpoints cluster heavily in EU, UK, AU, JP, and BR consumer/SMB networks. Ubiquiti hardware is operationally significant because it sits at the network edge of small businesses, residences, regional ISPs, and remote sites, meaning successful exploitation positions an attacker as a man-in-the-middle for all downstream traffic. Historical context underscores the risk: the FBI's Operation Dying Ember (February 2024) dismantled Moobot, a GRU-operated botnet built from Ubiquiti EdgeOS routers and used to proxy Russian cyber-espionage operations; CVE-2010-5330 (an older AirOS command injection) was added to the CISA KEV catalog in April 2022 with a federal remediation deadline. The combination of historical adversary interest, internet-scale exposure, low attack complexity, and a pre-auth RCE chain makes this advisory one of the most consequential network-perimeter disclosures of Q2 2026.

Defenders should treat any internet-exposed UniFi OS console as actively at risk and update to UniFi OS 5.1.12 / UniFi OS Server 5.0.8 immediately. As compensating controls, restrict TCP/443, TCP/8443, TCP/8080, and the UniFi Discovery protocol on UDP/10001 to management networks only; isolate UniFi consoles behind a VPN; rotate all administrator credentials, SSH host keys, and cloud-key API tokens after patching (because the path traversal may already have leaked them); and hunt for unexpected outbound connections from UniFi consoles, the creation of new admin users, or modifications to /data/unifi-core/config/users.json.

MITRE ATT&CK techniques used in TL-2026-0563

Credential Access

T1003 OS Credential Dumping; T1040 Network Sniffing; T1552 Unsecured Credentials

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Defense Evasion

T1070 Indicator Removal

Command and Control

T1071 Application Layer Protocol; T1090 Proxy

Persistence

T1098 Account Manipulation; T1136 Create Account

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Impact

T1498 Network Denial of Service

Lateral Movement

T1534 Internal Spearphishing; T1550 Use Alternate Authentication Material

Collection

T1557 Adversary-in-the-Middle; T1602 Data from Configuration Repository

Resource Development

T1587 Develop Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

defense-impairment

T1601 Modify System Image

Affected products and versions in Ubiquiti UniFi OS

  • Ubiquiti — UniFi OS (UniFi Cloud Gateways, Dream Machines, Cloud Keys, UniFi Express)
    Vulnerable versions: < 5.1.12
    Fixed in: 5.1.12
  • Ubiquiti — UniFi OS Server (self-hosted Linux/Windows/macOS controller)
    Vulnerable versions: < 5.0.8
    Fixed in: 5.0.8
  • Ubiquiti — UniFi Cloud Gateway Max / Ultra / Fiber
    Vulnerable versions: UniFi OS < 5.1.12
    Fixed in: UniFi OS 5.1.12
  • Ubiquiti — UniFi Dream Machine / Dream Machine Pro / Dream Machine SE / Dream Router
    Vulnerable versions: UniFi OS < 5.1.12
    Fixed in: UniFi OS 5.1.12
  • Ubiquiti — UniFi Cloud Key Gen2 / Cloud Key Gen2 Plus / UniFi Express
    Vulnerable versions: UniFi OS < 5.1.12
    Fixed in: UniFi OS 5.1.12

Remediation for Ubiquiti UniFi OS

Patches

  • UniFi OS 5.1.12 (UniFi Cloud Gateways, Dream Machines, Cloud Keys, UniFi Express)
  • UniFi OS Server 5.0.8 (self-hosted Linux/Windows/macOS controller)

Immediate actions

  • Update UniFi OS to version 5.1.12 on all UniFi Cloud Gateways, Dream Machines, Cloud Keys, and UniFi Express devices.
  • Update UniFi OS Server to version 5.0.8 on Linux, Windows, and macOS hosts running the self-hosted management stack.
  • Block public-internet exposure of TCP/443, TCP/8443 (UniFi Network UI), TCP/8080 (UniFi Inform), TCP/22 (SSH), and UDP/10001 (UniFi Discovery) on UniFi consoles at the upstream firewall until patches are applied.
  • Rotate every administrator password, API token, and SSH host key on the UniFi console — the path traversal (CVE-2026-34909) may already have exposed credentials.
  • Audit /data/unifi-core/config/users.json and the UniFi Network 'Admins' page for unauthorized administrator accounts created after 2026-04-01.

Workarounds

  • Restrict all UniFi management ports (443, 8443, 8080, 22, UDP 10001) to a management VLAN reachable only via VPN.
  • Disable Ubiquiti remote-access ('Site Manager / Cloud Access') on the console until patched if not operationally required.
  • Place a reverse proxy with mTLS in front of the UniFi UI to enforce client-certificate authentication while a maintenance window is scheduled.

Longer-term hardening

  • Place UniFi consoles behind a site-to-site VPN or zero-trust access broker so the management plane is never internet-reachable.
  • Enable Ubiquiti's automatic firmware update channel and subscribe to Security Advisory Bulletins so future fixes deploy within 24 hours of release.
  • Deploy network-edge IDS/IPS with signatures for path-traversal patterns ('../', URL-encoded traversal) and shell-metacharacter injection against the UniFi management URLs (/api/, /manage/account/, /inform).
  • Forward UniFi OS syslog (Settings -> System -> Remote Logging) to a SIEM and alert on new admin creation, configuration export events, and outbound connections from the console itself.
  • Maintain an asset inventory of UniFi appliances with their externally reachable IP, current firmware version, and last-patch date to accelerate the next emergency cycle.

CVEs associated with Ubiquiti UniFi OS

CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-33000, CVE-2026-34911

Weaknesses (CWE) in Ubiquiti UniFi OS

CWE-284, CWE-22, CWE-78, CWE-20, CWE-200

Timeline of Ubiquiti UniFi OS

  • CISA adds CVE-2010-5330 (Ubiquiti AirOS command injection) to the Known Exploited Vulnerabilities catalog with a federal remediation deadline.
  • FBI Operation Dying Ember dismantles Moobot, a botnet of compromised Ubiquiti EdgeOS routers operated by Russia's GRU Unit 26165, demonstrating sustained nation-state interest in Ubiquiti edge devices.
  • Estimated window when the five vulnerabilities were submitted to Ubiquiti via the HackerOne bug bounty program (based on standard 90-day coordinated-disclosure cadence).
  • Ubiquiti patches CVE-2026-22557 (UniFi Network Application account takeover, CVSS 10.0) and CVE-2026-22558 (privilege escalation), establishing a heightened patch cadence preceding the May 22 bulletin.
  • Threadlinqs Intelligence opens TL-2026-0563 to track exploitation, IOC emergence, and KEV listing for the cluster.
  • BleepingComputer publishes the first mainstream coverage with Censys exposure figures (~100,000 internet-exposed UniFi OS endpoints, ~50,000 in the United States).
  • UniFi OS 5.1.12 and UniFi OS Server 5.0.8 released through Ubiquiti auto-update channels.
  • Ubiquiti publishes Security Advisory Bulletin 064 disclosing CVE-2026-34908, CVE-2026-34909, CVE-2026-34910 (all CVSS 10.0 pre-auth), CVE-2026-33000 (critical post-auth command injection), and CVE-2026-34911 (high information disclosure).
  • First post-disclosure exposure scan baseline established; majority of endpoints remain on pre-5.1.12 versions, creating a 24-72 hour window of broad opportunistic exposure.
  • As of 2026-05-29, the UniFi OS Bulletin 064 cluster (3x CVSS-10 pre-auth RCE chain) is fixed in UniFi OS 5.1.12 / Server 5.0.8, with no confirmed in-the-wild exploitation, no public PoC, and no CISA KEV listing yet. It stays a live concern: ~100,000 mostly-unpatched internet-exposed devices, low attack complexity, and strong historical adversary interest keep it a top KEV/exploitation candidate.
  • Threadlinqs flags the cluster as a high-probability candidate for the CISA Known Exploited Vulnerabilities catalog within 14 days based on exposure scale and low attack complexity.

Sources cited for Ubiquiti UniFi OS

Threats related to Ubiquiti UniFi OS

Detection coverage for TL-2026-0563

As of 2026-05-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0563 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats