Skip to content
Sign in
CVE-2026-3490810.0CriticalCWE-284

CVE-2026-34908: Ubiquiti UniFi OS Improper Access Control Vulnerability

Ubiquiti · UniFi OS

Vendor fix available · Affected: Ubiquiti UniFi OS · Exploitation: in CISA KEV since 23 Jun

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue23 Jun
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub5 Jun
  5. Not established: not seen
88.9%probability of exploitation in the next 30 days
99th percentile
050100

Higher than 99% of scored CVEs

10.0CriticalCVSS 3.1
LowCrit.

Federal deadline

CISA KEV · added 23 Jun · catalogue entry

Passed 135 days ago

DescriptionNVD

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

What changed

  1. CISA added it to the KEV catalogue CISA
  2. PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage8 articles · 4 outlets

One row per outlet, in order of first report. First in our coverage: CISA, 23 Jun.

Full timeline
Quiet for 20 weekslast report 24 Jun8 articles4 outlets
23 Jun · CISA first10 Aug3 Sep27 SepNow
  • Tue 23 Jun, 19:50 UTC. CISA, first report. Critical Ubiquiti UniFi OS flaw exploited in the wild, no patch. Cites a CVE in CISA KEV.
  • Tue 23 Jun, 21:03 UTC. CISA. CISA adds Ubiquiti UniFi OS flaw CVE-2026-34908 to KEV list. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 02:02 UTC. SecurityOnline, its first report on the story. CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 03:41 UTC. SecurityOnline. Flaw in AVer PTC500S cameras allows remote code execution. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 04:11 UTC. SecurityOnline. Google Search Now Saves Your Uploaded Media to Train AI. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 04:11 UTC. SecurityOnline. Lantronix, UniFi flaws surface as Outlook Mac reply glitch seen. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 10:32 UTC. Security Affairs, its first report on the story. CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 13:01 UTC. SecurityWeek, its first report on the story. CISA urges patching as hackers exploit critical Ubiquiti flaws. Cites a CVE in CISA KEV.
All coveragerunning total8CISA2SecurityOnl…4Security Af…1SecurityWeek124 Jun10 Aug26 SepNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
8 articles about CVE-2026-34908 from 4 outlets
Published (UTC)OutletHeadline
23 Jun 19:50CISACritical Ubiquiti UniFi OS flaw exploited in the wild, no patch
23 Jun 21:03CISACISA adds Ubiquiti UniFi OS flaw CVE-2026-34908 to KEV list
24 Jun 02:02SecurityOnlineCISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog
24 Jun 03:41SecurityOnlineFlaw in AVer PTC500S cameras allows remote code execution
24 Jun 04:11SecurityOnlineGoogle Search Now Saves Your Uploaded Media to Train AI
24 Jun 04:11SecurityOnlineLantronix, UniFi flaws surface as Outlook Mac reply glitch seen
24 Jun 10:32Security AffairsCISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026
24 Jun 13:01SecurityWeekCISA urges patching as hackers exploit critical Ubiquiti flaws
  1. CISA urges patching as hackers exploit critical Ubiquiti flaws
    SecurityWeek
  2. CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026
    Security Affairs · mentions it in passing
  3. Lantronix, UniFi flaws surface as Outlook Mac reply glitch seen
    SecurityOnline · mentions it in passing
  4. Google Search Now Saves Your Uploaded Media to Train AI
    SecurityOnline · mentions it in passing
  5. Flaw in AVer PTC500S cameras allows remote code execution
    SecurityOnline · mentions it in passing
  6. CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog
    SecurityOnline
  7. CISA adds Ubiquiti UniFi OS flaw CVE-2026-34908 to KEV list
    CISA · official notice
  8. Critical Ubiquiti UniFi OS flaw exploited in the wild, no patch
    CISA · official notice · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in