Three critical vulnerabilities in Ubiquiti UniFi OS devices (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) allow remote unauthenticated attackers to bypass authentication via crafted requests exploiting how NGINX processes them, perform path traversal to access and manipulate OS files, and conduct command injection through improper input validation of package names during updates. These combined flaws enable attackers to create rogue administrator accounts and execute arbitrary commands remotely. A variant requiring authentication (CVE-2026-33000) also exists. Ubiquiti patched these issues in UniFi OS Server version 5.0.8 released on May 21, 2026. CISA added these vulnerabilities to its KEV catalog, mandating patching within three days for federal agencies. Analysis by BishopFox confirmed the authentication bypass and command injection on version 5.0.6. The vulnerabilities pose significant risk as UniFi OS devices centrally manage network infrastructure, facilitating potential lateral movement in enterprise environments.

Successful exploitation allows remote unauthenticated attackers to bypass authentication controls, make unauthorized system changes, access and manipulate underlying operating system files, create rogue administrator accounts, and execute arbitrary commands on UniFi OS devices. This compromises device integrity and confidentiality, potentially enabling attackers to move laterally within enterprise networks managed by these devices. The vulnerabilities have a maximum CVSS score of 10.0, indicating critical severity. Exploitation has been reported in the wild prior to patch availability, increasing risk to affected organizations.

Ubiquiti released patches addressing these vulnerabilities in UniFi OS Server version 5.0.8 on May 21, 2026. Organizations should promptly update to this version or later to remediate the issues. The US CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalog and recommends patching within three days. No alternative mitigations or workarounds are indicated. Patch status is confirmed as official fix available in version 5.0.8.