CVE-2026-3491010.0CriticalCWE-20
CVE-2026-34910: Ubiquiti UniFi OS Improper Input Validation Vulnerability
Ubiquiti · UniFi OS
Vendor fix available · Affected: Ubiquiti UniFi OS · Exploitation: in CISA KEV since 23 Jun
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue23 Jun
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub9 Aug
- Not established: not seen
90.0%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
10.0CriticalCVSS 3.1
LowMediumHighCrit.
Federal deadline
CISA KEV · added 23 Jun · catalogue entry
Passed 135 days ago
DescriptionNVD
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
What changed
- PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub
- CISA added it to the KEV catalogue CISA
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage8 articles · 4 outlets
One row per outlet, in order of first report. First in our coverage: CISA, 23 Jun.
Quiet for 20 weekslast report 24 Jun8 articles4 outlets
- Tue 23 Jun, 19:41 UTC. CISA, first report. CISA Flags Critical UniFi OS Flaw as Actively Exploited, No Patch. Cites a CVE in CISA KEV.
- Tue 23 Jun, 19:47 UTC. CISA. CISA flags active exploit in Ubiquiti UniFi OS CVE-2026-34910. Cites a CVE in CISA KEV.
- Wed 24 Jun, 02:02 UTC. SecurityOnline, its first report on the story. CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog. Cites a CVE in CISA KEV.
- Wed 24 Jun, 03:41 UTC. SecurityOnline. Flaw in AVer PTC500S cameras allows remote code execution. Cites a CVE in CISA KEV.
- Wed 24 Jun, 04:11 UTC. SecurityOnline. Google Search Now Saves Your Uploaded Media to Train AI. Cites a CVE in CISA KEV.
- Wed 24 Jun, 04:11 UTC. SecurityOnline. Lantronix, UniFi flaws surface as Outlook Mac reply glitch seen. Cites a CVE in CISA KEV.
- Wed 24 Jun, 10:32 UTC. Security Affairs, its first report on the story. CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026. Cites a CVE in CISA KEV.
- Wed 24 Jun, 13:01 UTC. SecurityWeek, its first report on the story. CISA urges patching as hackers exploit critical Ubiquiti flaws. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 23 Jun 19:41 | CISA | CISA Flags Critical UniFi OS Flaw as Actively Exploited, No Patch |
| 23 Jun 19:47 | CISA | CISA flags active exploit in Ubiquiti UniFi OS CVE-2026-34910 |
| 24 Jun 02:02 | SecurityOnline | CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog |
| 24 Jun 03:41 | SecurityOnline | Flaw in AVer PTC500S cameras allows remote code execution |
| 24 Jun 04:11 | SecurityOnline | Google Search Now Saves Your Uploaded Media to Train AI |
| 24 Jun 04:11 | SecurityOnline | Lantronix, UniFi flaws surface as Outlook Mac reply glitch seen |
| 24 Jun 10:32 | Security Affairs | CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026 |
| 24 Jun 13:01 | SecurityWeek | CISA urges patching as hackers exploit critical Ubiquiti flaws |
- CISA urges patching as hackers exploit critical Ubiquiti flawsSecurityWeek · mentions it in passing
- CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026Security Affairs · mentions it in passing
- Lantronix, UniFi flaws surface as Outlook Mac reply glitch seenSecurityOnline · mentions it in passing
- Google Search Now Saves Your Uploaded Media to Train AISecurityOnline · mentions it in passing
- Flaw in AVer PTC500S cameras allows remote code executionSecurityOnline · mentions it in passing
- CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV CatalogSecurityOnline · mentions it in passing
- CISA flags active exploit in Ubiquiti UniFi OS CVE-2026-34910CISA · official notice
- CISA Flags Critical UniFi OS Flaw as Actively Exploited, No PatchCISA · official notice · first in our coverage
New articles also arrive in the RSS feed.