VulnerabilityPublished 24 Jun 2026

Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs

Source SecurityWeek

Mentioned vulnerabilities

Fixed in 5.0.8 : patch affected systems as a priority.

Data as of 24 Jun 2026, 22:21 UTC

Severity

Critical

Rated by Threat Radar

Patch: Available – fixed in 5.0.8

remote

What to do

AI-suggested

Ubiquiti released patches addressing these vulnerabilities in UniFi OS Server version 5.0.8 on May 21, 2026. Organizations should promptly update to this version or later to remediate the issues. The US CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalog and recommends patching within three days. No alternative mitigations or workarounds are indicated. Patch status is confirmed as official fix available in version 5.0.8.

Description

The flaws allow remote, unauthenticated attackers to make system changes, access underlying accounts, and inject commands. The post Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs appeared first on SecurityWeek .

Impact

Successful exploitation allows remote unauthenticated attackers to bypass authentication controls, make unauthorized system changes, access and manipulate underlying operating system files, create rogue administrator accounts, and execute arbitrary commands on UniFi OS devices. This compromises device integrity and confidentiality, potentially enabling attackers to move laterally within enterprise networks managed by these devices. The vulnerabilities have a maximum CVSS score of 10.0, indicating critical severity. Exploitation has been reported in the wild prior to patch availability, increasing risk to affected organizations.

Summary

Three critical vulnerabilities in Ubiquiti UniFi OS devices (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) allow remote unauthenticated attackers to bypass authentication via crafted requests exploiting how NGINX processes them, perform path traversal to access and manipulate OS files, and conduct command injection through improper input validation of package names during updates. These combined flaws enable attackers to create rogue administrator accounts and execute arbitrary commands remotely. A variant requiring authentication (CVE-2026-33000) also exists. Ubiquiti patched these issues in UniFi OS Server version 5.0.8 released on May 21, 2026. CISA added these vulnerabilities to its KEV catalog, mandating patching within three days for federal agencies. Analysis by BishopFox confirmed the authentication bypass and command injection on version 5.0.6. The vulnerabilities pose significant risk as UniFi OS devices centrally manage network infrastructure, facilitating potential lateral movement in enterprise environments.

References

securityweek.com/critical-ubiquiti-vulnerabilities-in-attackers-crosshairs/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 24 Jun 2026, 12:39 UTC

References

Community reviews

Related threats