# Ubiquiti UniFi OS — Three Max-Severity Pre-Auth Vulnerabilities (CVE-2026-34908 / 34909 / 34910) in Security Advisory Bulletin 064

> Ubiquiti's Security Advisory Bulletin 064 (2026-05-22) patches five UniFi OS flaws, three of which are CVSS 10.0 and pre-authentication: CVE-2026-34908 (Improper Access Control), CVE-2026-34909 (Path Traversal), and CVE-2026-34910 (Command Injection via Improper Input Validation). The cluster also includes CVE-2026-33000 (post-auth command injection) and CVE-2026-34911 (information disclosure). Censys tracks ~100,000 internet-exposed UniFi OS endpoints (~50,000 in the United States), producing one of the largest immediate pre-auth attack surfaces of 2026; fixes ship in UniFi OS 5.1.12 and UniFi OS Server 5.0.8.

- **Published:** 2026-05-22T12:00:00Z
- **Last reviewed:** 2026-05-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0563
- **ID:** TL-2026-0563
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-33000, CVE-2026-34911, CVE-2010-5330

## Description

On 2026-05-22, Ubiquiti published Security Advisory Bulletin 064 addressing five vulnerabilities in UniFi OS, the unified operating system that powers UniFi Cloud Gateways, UniFi Dream Machines, UniFi Express, and the UniFi OS Server (Linux/Windows/macOS) variant. Three of the five flaws — CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 — carry the maximum CVSS v3.1 base score of 10.0 and are exploitable without authentication over the network. All five were reported through Ubiquiti's HackerOne bug bounty program and were patched in UniFi OS 5.1.12 and UniFi OS Server 5.0.8.

CVE-2026-34908 is an Improper Access Control (CWE-284) defect that permits a remote unauthenticated attacker to make unauthorized changes to the configuration and state of an affected UniFi OS console. Because UniFi OS exposes management surfaces (HTTPS on TCP/443, the UniFi Network UI on TCP/8443, and the UniFi Inform channel on TCP/8080) by default on cloud-gateway products, an attacker who can reach any of these ports can drive privileged state transitions without supplying credentials. The flaw is the foundation of the most severe exploit chain because it allows the unauthenticated caller to invoke functionality previously restricted to administrators — notably the device-management, backup-restore, and update-orchestration endpoints.

CVE-2026-34909 is a Path Traversal (CWE-22) vulnerability that lets the same unauthenticated network attacker step outside the intended file scope and read arbitrary files from the underlying Linux root filesystem. Ubiquiti's own description states the flaw can be manipulated to 'access an underlying account', which in practice means reading the cleartext or hashed credential material the UniFi OS stack stores on disk (administrator account files under /data/unifi-core/config, SQLite databases under /data/unifi/db, and SSH host keys under /etc/ssh). Once an attacker reads these artifacts they can either authenticate to the appliance directly or crack the stored hash offline, transforming a read-only file disclosure into full account takeover.

CVE-2026-34910 is an Improper Input Validation defect (CWE-78 OS Command Injection) reachable after the attacker has 'gained network access' to UniFi OS — meaning the attacker can supply attacker-controlled command fragments to a request handler that ultimately invokes a shell, system(), or popen() with insufficient sanitization. Concatenating CVE-2026-34908 (bypass of the auth gate), CVE-2026-34909 (read of secrets from disk), and CVE-2026-34910 (arbitrary command execution as the unifi service user) yields a complete remote, unauthenticated root-equivalent RCE chain on the appliance. Because UniFi OS runs as root on most cloud-gateway hardware and the unifi-core service has effective sudo privileges, post-exploitation provides device-takeover capability suitable for botnet recruitment, persistent residential/SMB proxy networks, or pivoting into the LAN segment the appliance routes.

CVE-2026-33000 is a second OS command injection that requires authentication and is rated Critical; it is most useful as a privilege-escalation primitive after credentials are obtained, but is also exploitable directly by any legitimate UniFi OS user. CVE-2026-34911 is a high-severity Information Disclosure that leaks system metadata which is useful for fingerprinting affected versions and selecting payloads — the natural reconnaissance partner for the pre-auth chain above.

Exposure data from Censys (cited by BleepingComputer) shows roughly 100,000 UniFi OS management surfaces reachable from the public internet, with approximately half (~50,000 IPs) located in the United States. The remaining endpoints cluster heavily in EU, UK, AU, JP, and BR consumer/SMB networks. Ubiquiti hardware is operationally significant because it sits at the network edge of small businesses, residences, regional ISPs, and remote sites, meaning successful exploitation positions an attacker as a man-in-the-middle for all downstream traffic. Historical context underscores the risk: the FBI's Operation Dying Ember (February 2024) dismantled Moobot, a GRU-operated botnet built from Ubiquiti EdgeOS routers and used to proxy Russian cyber-espionage operations; CVE-2010-5330 (an older AirOS command injection) was added to the CISA KEV catalog in April 2022 with a federal remediation deadline. The combination of historical adversary interest, internet-scale exposure, low attack complexity, and a pre-auth RCE chain makes this advisory one of the most consequential network-perimeter disclosures of Q2 2026.

Defenders should treat any internet-exposed UniFi OS console as actively at risk and update to UniFi OS 5.1.12 / UniFi OS Server 5.0.8 immediately. As compensating controls, restrict TCP/443, TCP/8443, TCP/8080, and the UniFi Discovery protocol on UDP/10001 to management networks only; isolate UniFi consoles behind a VPN; rotate all administrator credentials, SSH host keys, and cloud-key API tokens after patching (because the path traversal may already have leaked them); and hunt for unexpected outbound connections from UniFi consoles, the creation of new admin users, or modifications to /data/unifi-core/config/users.json.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1070 Indicator Removal
- T1601 Modify System Image
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1040 Network Sniffing
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1534 Internal Spearphishing
- T1550 Use Alternate Authentication Material
- T1602 Data from Configuration Repository
- T1557 Adversary-in-the-Middle
- T1071 Application Layer Protocol
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1498 Network Denial of Service

## Sources

- [Ubiquiti patches three max severity UniFi OS vulnerabilities (BleepingComputer)](https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-unifi-os-vulnerabilities/)
- [Ubiquiti Security Advisory Bulletin 064](https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b)
- [NVD — CVE-2026-34908 (Improper Access Control)](https://nvd.nist.gov/vuln/detail/CVE-2026-34908)
- [NVD — CVE-2026-34909 (Path Traversal)](https://nvd.nist.gov/vuln/detail/CVE-2026-34909)
- [NVD — CVE-2026-34910 (Improper Input Validation / Command Injection)](https://nvd.nist.gov/vuln/detail/CVE-2026-34910)
- [NVD — CVE-2026-33000 (Authenticated Command Injection)](https://nvd.nist.gov/vuln/detail/CVE-2026-33000)
- [NVD — CVE-2026-34911 (Information Disclosure)](https://nvd.nist.gov/vuln/detail/CVE-2026-34911)
- [Tenable Research — CVE-2026-34908](https://www.tenable.com/cve/CVE-2026-34908)
- [Censys — UniFi OS Internet Exposure Snapshot](https://search.censys.io/search?q=services.software.product%3A%22UniFi+OS%22)
- [FBI — Operation Dying Ember (Moobot / Ubiquiti EdgeOS / GRU)](https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian)
- [CISA KEV — CVE-2010-5330 Ubiquiti AirOS Command Injection](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Ubiquiti HackerOne Program](https://hackerone.com/ubiquiti)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0563