CVE-2026-34908
Ubiquiti UniFi OS Improper Access Control Vulnerability
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Deadline for federal agencies: 2026-06-26.
9 articles across 5 outlets · first covered Jun 23, 2026 · latest Jun 24, 2026
Coverage timeline
-
CISA urges patching as hackers exploit critical Ubiquiti flawswww.securityweek.com · Jun 24, 2026
-
CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026securityaffairs.com · Jun 24, 2026
-
SmartRAT ClickFix targets Brazilian banks with AI spoofed domainssecurityonline.info · Jun 24, 2026
-
Lantronix, UniFi flaws surface as Outlook Mac reply glitch seensecurityonline.info · Jun 24, 2026
-
Google Search Now Saves Your Uploaded Media to Train AIsecurityonline.info · Jun 24, 2026
-
Flaw in AVer PTC500S cameras allows remote code executionsecurityonline.info · Jun 24, 2026
-
CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalogsecurityonline.info · Jun 24, 2026
-
CISA adds Ubiquiti UniFi OS flaw CVE-2026-34908 to KEV listwww.cisa.gov · Jun 23, 2026
-
Critical Ubiquiti UniFi OS flaw exploited in the wild, no patchcisa.gov · Jun 23, 2026