Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog

Part of the CVE-2026-34908 story · since 23 Jun

Quiet for 20 weekslast report 24 Jun9 articles4 outlets
23 Jun · CISA first10 Aug3 Sep27 SepNowThis article3rd of 9
  • Tue 23 Jun, 19:50 UTC. CISA, first report. Critical Ubiquiti UniFi OS flaw exploited in the wild, no patch. Cites a CVE in CISA KEV.
  • Tue 23 Jun, 21:03 UTC. CISA. CISA adds Ubiquiti UniFi OS flaw CVE-2026-34908 to KEV list. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 02:02 UTC. SecurityOnline, its first report on the story. CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog. Cites a CVE in CISA KEV. This article, 3rd of 9.
  • Wed 24 Jun, 03:41 UTC. SecurityOnline. Flaw in AVer PTC500S cameras allows remote code execution. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 04:11 UTC. SecurityOnline. Google Search Now Saves Your Uploaded Media to Train AI. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 04:11 UTC. SecurityOnline. Lantronix, UniFi flaws surface as Outlook Mac reply glitch seen. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 08:13 UTC. SecurityOnline. SmartRAT ClickFix targets Brazilian banks with AI spoofed domains. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 10:32 UTC. Security Affairs, its first report on the story. CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 13:01 UTC. SecurityWeek, its first report on the story. CISA urges patching as hackers exploit critical Ubiquiti flaws. Cites a CVE in CISA KEV.

CISA has identified four actively exploited vulnerabilities affecting Ubiquiti UniFi OS and Lantronix EDS5000 devices as of June 23, 2026. The vulnerabilities are critically rated, with CVSS scores reaching 10.0. Details include: 1) CVE-2026-34908: Improper Access Control; 2) CVE-2026-34909: Path Traversal; 3) CVE-2026-34910: Improper Input Validation; and 4) CVE-2025-67038: Code Injection. Users are urged to update their systems by June 26, 2026, to mitigate risks, as intrusions could lead to unauthorized control of devices.

How the story developed

All 9 articles
Quiet for 20 weekslast report 24 Jun9 articles4 outlets

9 articles from 4 outlets since 23 Jun. Quiet since 24 Jun. This was the 3rd report, 6 hours after the first.

Now23 Jun2425268 Nov9First reportCISA · 23 Jun, 19:50This article3rd of 9 · day 1
  • Tue 23 Jun, 19:50 UTC. CISA, first report. Critical Ubiquiti UniFi OS flaw exploited in the wild, no patch. Cites a CVE in CISA KEV.
  • Tue 23 Jun, 21:03 UTC. CISA. CISA adds Ubiquiti UniFi OS flaw CVE-2026-34908 to KEV list. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 02:02 UTC. SecurityOnline, its first report on the story. CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog. Cites a CVE in CISA KEV. This article, 3rd of 9.
  • Wed 24 Jun, 03:41 UTC. SecurityOnline. Flaw in AVer PTC500S cameras allows remote code execution. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 04:11 UTC. SecurityOnline. Google Search Now Saves Your Uploaded Media to Train AI. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 04:11 UTC. SecurityOnline. Lantronix, UniFi flaws surface as Outlook Mac reply glitch seen. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 08:13 UTC. SecurityOnline. SmartRAT ClickFix targets Brazilian banks with AI spoofed domains. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 10:32 UTC. Security Affairs, its first report on the story. CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 13:01 UTC. SecurityWeek, its first report on the story. CISA urges patching as hackers exploit critical Ubiquiti flaws. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Tue 23 JunDay 02
    1. Critical Ubiquiti UniFi OS flaw exploited in the wild, no patch19:50 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA adds Ubiquiti UniFi OS flaw CVE-2026-34908 to KEV list21:03 · CISA · official · Known exploited CVE
  2. Wed 24 JunDay 17
    1. CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog02:02 · SecurityOnline · Known exploited CVE · This article, 3rd of 9
    2. Flaw in AVer PTC500S cameras allows remote code execution03:41 · SecurityOnline · Known exploited CVE
    3. Google Search Now Saves Your Uploaded Media to Train AI04:11 · SecurityOnline · Known exploited CVE
    Show 4 more from 24 Jun
    1. Lantronix, UniFi flaws surface as Outlook Mac reply glitch seen04:11 · SecurityOnline · Known exploited CVE
    2. SmartRAT ClickFix targets Brazilian banks with AI spoofed domains08:13 · SecurityOnline · Known exploited CVE
    3. CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 202610:32 · Security Affairs · Known exploited CVE
    4. CISA urges patching as hackers exploit critical Ubiquiti flaws13:01 · SecurityWeek · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in