What is the CVSS score of CVE-2026-34908?

CVE-2026-34908 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-34908?

Yes, a public proof-of-concept exploit is available for CVE-2026-34908. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-34908?

Within 24 hours: Inventory all UniFi OS devices and determine network exposure (which are internet-facing or accessible from untrusted segments). Within 7 days: Implement network segmentation to restrict UniFi management plane access to trusted administrative networks only; disable remote management if possible; require VPN for any off-site access. Within 30 days: Monitor vendor advisories for patch release and apply immediately upon availability; establish incident response procedures for UniFi compromise.

Ubiquiti UniFi OS CVE-2026-34908

Q: Which versions of Ubiquiti UniFi OS are affected by CVE-2026-34908?

Ubiquiti UniFi OS devices face complete unauthorized system modification through unauthenticated network access, affecting critical network infrastructure components including gateways, NVRs, and…. A patch is available.

EUVD-2026-31383 CRITICAL

Improper Access Control (CWE-284)

2026-05-22 hackerone

GHSA-p8c5-xwrc-584f

Authentication Bypass Udm Udr Ubiquiti Unifi Os Server Udm Pro Udm Se Udm Pro Max Udm Beast Efg Udw Udr7 Udr 5G Express 7 Unvr Unvr Pro Unvr Instant Unvr G2 Unvr G2 Pro Envr Envr Core Unas 2 Unas 4 Unas Pro Unas Pro 4 Unas Pro 8 Uckp Uck Uck Enterprise Ucg Ultra Ucg Max Ucg Fiber Ucg Industrial Ubiquiti Inc

10.0

CVSS 3.1 · Vendor: hackerone

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach UniFi OS management interface on network
Delivery

Send crafted request bypassing access control
Exploit

Invoke privileged system-modification endpoint
Execution

Alter firewall/admin/NVR configuration
Impact

Achieve full device compromise across scope boundary

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Attacker requires network reachability to the UniFi OS management interface of an affected device (UDM, UDR, UCG, UCK, UNVR, UNAS, EFG, or UDW family running vulnerable UniFi OS). No authentication, user interaction, or special configuration is needed per CVSS PR:N/UI:N - the bypass works against default deployments. Exploitation is limited to networks where the management plane is reachable from the attacker's position; deployments that segregate management onto a dedicated VLAN unreachable from client/guest networks materially reduce exposure, and devices not exposed to WAN are not directly attackable from the internet.
Impact	Signals are uniformly severe: CVSS 10.0 with AV:N/AC:L/PR:N/UI:N indicates a trivial network-reachable bypass with no user interaction, and S:C/C:H/I:H/A:H indicates full compromise extending beyond the affected component. No EPSS score, KEV listing, or POC indicator was provided in the input, so widespread automated exploitation is not yet evidenced; however, the absence of EPSS/KEV data should not be interpreted as low risk given the trivial attack profile and the large installed base of internet-exposed UniFi controllers. The description states 'access to the network' which is consistent with AV:N but in practice many UniFi management interfaces are reachable only on LAN - defenders should verify whether their controller is exposed to WAN or guest VLANs before assuming worst-case reachability.
Exploit ScenarioDerived	An attacker on the same LAN or VLAN as a UniFi OS device (for example via a guest Wi-Fi network sharing the same management subnet, or a compromised IoT device) sends crafted requests to the management interface that bypass access control checks. The attacker then modifies firewall rules, creates an admin account, or alters NVR/NAS configuration to exfiltrate footage or stored data - all without supplying valid credentials.

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 22, 2026

Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configuration without authentication, affecting a broad range of UniFi gateways, dream machines, NVRs, NAS units, and cloud keys. The maximum CVSS 10.0 score reflects network-reachable, unauthenticated exploitation with scope change and full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis, but the authentication bypass nature elevates urgency for any UniFi management plane exposed beyond trusted segments.

RemediationAI

Patch available per vendor advisory - consult Ubiquiti Security Advisory Bulletin 064 at https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b for the exact fixed UniFi OS firmware version for each device model, as the input does not enumerate fix versions. Until firmware can be applied, restrict the UniFi OS management interface (typically TCP 443 and 8443) to a dedicated management VLAN or VPN, and ensure WAN-side management is disabled - note that disabling remote access will break Ubiquiti's UI.com cloud SSO workflow for off-network admins. As a compensating control, place the controller behind a firewall rule that allows only known admin IPs to reach the web UI; this does not prevent lateral movement from a compromised internal host but eliminates external exposure.

Affected VersionsENISA

UniFi OS Server 0 <5.0.8

UCK 0 <5.1.12

UDR7 0 <5.1.12

UDM-Pro-Max 0 <5.1.12

ENVR-Core 0 <5.1.12

UNVR-G2-Pro 0 <5.1.12

UDM-Pro 0 <5.1.12

EFG 0 <5.1.12

UDW 0 <5.1.12

udr 0 <5.1.12

UCG-Ultra 0 <5.1.12

UNAS-2 0 <5.1.10

UNAS-Pro-4 0 <5.1.10

UDM 0 <5.1.12

Express 7 0 <5.1.12

UNAS-4 0 <5.1.10

UCG-Fiber 0 <5.1.12

UNAS-Pro-8 0 <5.1.10

UCKP 0 <5.1.12

UCG-Industrial 0 <5.1.12

ENVR 0 <5.1.12

UDR-5G 0 <5.1.12

UNVR-Pro 0 <5.1.12

UCG-Max 0 <5.1.12

UDM-Beast 0 <5.1.11

UNVR-Instant 0 <5.1.12

UNVR 0 <5.1.12

UNAS-Pro 0 <5.1.10

UDM-SE 0 <5.1.12

UNVR-G2 0 <5.1.12

UCK-Enterprise 0 <5.1.12

Affected Packages

euvd efg fix: 5.1.12

euvd envr fix: 5.1.12

euvd envr_core fix: 5.1.12

euvd express_7 fix: 5.1.12

euvd ucg_fiber fix: 5.1.12

euvd ucg_industrial fix: 5.1.12

euvd ucg_max fix: 5.1.12

euvd ucg_ultra fix: 5.1.12

euvd uck fix: 5.1.12

euvd uck_enterprise fix: 5.1.12

euvd uckp fix: 5.1.12

euvd udm fix: 5.1.12

euvd udm_beast fix: 5.1.11

euvd udm_pro fix: 5.1.12

euvd udm_pro_max fix: 5.1.12

euvd udm_se fix: 5.1.12

euvd udr fix: 5.1.12

euvd udr7 fix: 5.1.12

euvd udr_5g fix: 5.1.12

euvd udw fix: 5.1.12

euvd unas_2 fix: 5.1.10

euvd unas_4 fix: 5.1.10

euvd unas_pro fix: 5.1.10

euvd unas_pro_4 fix: 5.1.10

euvd unas_pro_8 fix: 5.1.10

euvd unifi_os_server fix: 5.0.8

euvd unvr fix: 5.1.12

euvd unvr_g2 fix: 5.1.12

euvd unvr_g2_pro fix: 5.1.12

euvd unvr_instant fix: 5.1.12

euvd unvr_pro fix: 5.1.12

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 31 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

UniFi OS is Ubiquiti's unified operating system that runs on the UDM (Dream Machine) line, UDR routers, UCG cloud gateways, UCK/UCKP cloud keys, UNVR network video recorders, UNAS storage appliances, and the EFG/UDW edge platforms. The flaw is classified as CWE-284 (Improper Access Control), meaning authorization checks for privileged system-modifying operations are missing or bypassable. The CVSS scope change (S:C) signals that exploitation crosses a trust boundary - the affected component can influence resources beyond its own security authority, which on a converged network appliance like UniFi OS typically means routing, firewall, VPN, or camera/storage subsystems controlled by the same management plane.

Know when Udm gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (hackerone) PRIMARY 10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (hackerone) · only source for this CVE.

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jun 23, 2026 - 18:17 CISA

Patch available

May 22, 2026 - 02:01 EUVD

DescriptionCVE.org

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

Articles & Coverage 1

POC CVE-2026-34908: Unauthenticated RCE Chain in UniFi OS Server via Auth Bypass and Path Traversal Jun 05, 2026

Executive ViewAI

Why It Matters

Ubiquiti UniFi OS devices face complete unauthorized system modification through unauthenticated network access, affecting critical network infrastructure components including gateways, NVRs, and cloud management systems across enterprise deployments. This critical flaw (CVSS 10.0) enables attackers to gain full system control without credentials, creating severe risk for any organization managing UniFi infrastructure connected to untrusted networks.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to management interfaces via firewall rules and network segmentation-limit to trusted administrative subnets only; (2) Disable remote management features and cloud access if operationally feasible; (3) Implement continuous network monitoring and logging for unauthorized configuration changes; (4) Maintain offline backups of configuration to enable rapid recovery if compromise occurs; (5) Establish daily audit logs review for suspicious activity.

Threat Intelligence Overview

Threat Score

5.0/10

Composite threat intelligence

EPSS Score

0.0%

Top 95% exploitable

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

CISA KEV

EPSS

Vulnrichment NEWS POC (1)

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.