CVE-2026-3490910.0CriticalCWE-22
CVE-2026-34909: Ubiquiti UniFi OS Path Traversal Vulnerability
Ubiquiti · UniFi OS
Vendor fix available · Affected: Ubiquiti UniFi OS · Exploitation: in CISA KEV since 23 Jun
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue23 Jun
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not established: not seen
68.0%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
10.0CriticalCVSS 3.1
LowMediumHighCrit.
Federal deadline
CISA KEV · added 23 Jun · catalogue entry
Passed 135 days ago
DescriptionNVD
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.
What changed
- CISA added it to the KEV catalogue CISA
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage7 articles · 4 outlets
One row per outlet, in order of first report. First in our coverage: CISA, 23 Jun.
Quiet for 20 weekslast report 24 Jun7 articles4 outlets
- Tue 23 Jun, 19:42 UTC. CISA, first report. CISA adds CVE-2026-34909 to KEV as UniFi OS flaw exploited. Cites a CVE in CISA KEV.
- Wed 24 Jun, 02:02 UTC. SecurityOnline, its first report on the story. CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog. Cites a CVE in CISA KEV.
- Wed 24 Jun, 03:41 UTC. SecurityOnline. Flaw in AVer PTC500S cameras allows remote code execution. Cites a CVE in CISA KEV.
- Wed 24 Jun, 04:11 UTC. SecurityOnline. Google Search Now Saves Your Uploaded Media to Train AI. Cites a CVE in CISA KEV.
- Wed 24 Jun, 04:11 UTC. SecurityOnline. Lantronix, UniFi flaws surface as Outlook Mac reply glitch seen. Cites a CVE in CISA KEV.
- Wed 24 Jun, 10:32 UTC. Security Affairs, its first report on the story. CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026. Cites a CVE in CISA KEV.
- Wed 24 Jun, 13:01 UTC. SecurityWeek, its first report on the story. CISA urges patching as hackers exploit critical Ubiquiti flaws. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 23 Jun 19:42 | CISA | CISA adds CVE-2026-34909 to KEV as UniFi OS flaw exploited |
| 24 Jun 02:02 | SecurityOnline | CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog |
| 24 Jun 03:41 | SecurityOnline | Flaw in AVer PTC500S cameras allows remote code execution |
| 24 Jun 04:11 | SecurityOnline | Google Search Now Saves Your Uploaded Media to Train AI |
| 24 Jun 04:11 | SecurityOnline | Lantronix, UniFi flaws surface as Outlook Mac reply glitch seen |
| 24 Jun 10:32 | Security Affairs | CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026 |
| 24 Jun 13:01 | SecurityWeek | CISA urges patching as hackers exploit critical Ubiquiti flaws |
- CISA urges patching as hackers exploit critical Ubiquiti flawsSecurityWeek · mentions it in passing
- CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026Security Affairs · mentions it in passing
- Lantronix, UniFi flaws surface as Outlook Mac reply glitch seenSecurityOnline · mentions it in passing
- Google Search Now Saves Your Uploaded Media to Train AISecurityOnline · mentions it in passing
- Flaw in AVer PTC500S cameras allows remote code executionSecurityOnline · mentions it in passing
- CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV CatalogSecurityOnline · mentions it in passing
- CISA adds CVE-2026-34909 to KEV as UniFi OS flaw exploitedCISA · official notice · first in our coverage
New articles also arrive in the RSS feed.