CVE-2026-34909

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-34909 10.0

Ubiquiti · UniFi OS · Added 2026-06-23 · Published 2026-05-22

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityUbiquiti UniFi OS Path Traversal Vulnerability

VendorUbiquiti

ProductUniFi OS

Date added2026-06-23

Due date2026-06-26

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-22

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.

NVD: A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-27 14:30 UTC

Wall time9.1s

Searches1

Component defaultunknown

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-34909
https://threat-modeling.com/cve-2026-34908-34909-34910-ubiquiti-unifi-os-triple-kev/
https://github.com/BishopFox/CVE-2026-34908-check
https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis
https://www.thestack.technology/ubiquiti-vulnerability-exploited-in-the-wild/
https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

warn component_extraction: Component 'UniFi OS nginx auth gateway raw-vs-normalized URI comparison' matches or contains product name 'UniFi OS' — no specific component identified

Hunting hypothesis agent

Hunt nginx logs on TCP 11443 for GET /api/auth/validate-sso/ with encoded traversal (%2f, ..%2f) in the URI — legitimate requests never carry traversal, indicating the auth-gateway bypass chain.

Research details

ComponentUniFi OS nginx auth gateway raw-vs-normalized URI comparison

PreconditionsNetwork reachability to UniFi OS device management interface (TCP 11443 by default); no authentication required when chained with CVE-2026-34908; affects UniFi OS Server <= 5.0.6 and per-model fixed versions for hardware (Cloud Gateways, Dream Machines, NVRs, UNAS to 5.1.10+, UniFi Express to 4.0.14+). The path traversal (CVE-2026-34909) is the second link in the chain after CVE-2026-34908 (auth bypass). agent

DeliveryGET request with /api/auth/validate-sso/ prefix and encoded path-traversal sequences (..%2f, %2f) that bypass nginx auth gateway, routing to authenticated internal /proxy/<service>/ backend endpoints

Public PoCyes

PoC URLs https://github.com/BishopFox/CVE-2026-34908-check Third-party repos; verify before use.

Advisoryhttps://community.ui.com/releases/UniFi-Application-Firmware-5-0-25/d1a8d1c5-8d0e-4a37-963a-4b0f5b8f9c9a

Exploit notesCVSS 10.0 CRITICAL | Part of 3-CVE chain: CVE-2026-34908 (improper access control) + CVE-2026-34909 (path traversal) = auth-gateway bypass, then CVE-2026-34910 (command injection) = unauthenticated RCE | BishopFox confirmed full chain: single unauthenticated request to root shell on live 5.0.6 target | The auth bypass exploits a divergence between nginx raw URI ($request_uri, percent-encoded) and normalized URI ($uri, decoded) — /api/auth/validate-sso/ prefix is public but ..%2f traversal resolves to authenticated /proxy/<service>/ routes | BishopFox published safe detection tool (66 stars) confirming bypass via missing-pkg_name probe returning 200 + handler error | Post-exploitation: root reads JWT signing key, TLS private keys, cloud tokens, user DB, RADIUS/WiFi/VPN secrets, NFC/biometric data | Forged admin tokens survive patching until signing key rotation | Active exploitation in wild, fixed in UOS 5.0.8

SummaryUbiquiti UniFi OS path traversal (CWE-22, CVE-2026-34909) is the second link in a 3-CVE unauthenticated RCE chain. The nginx auth gateway treats raw URIs starting with /api/auth/validate-sso/ as public, but normalizes the path to reach authenticated backends. Traversal sequences (..%2f) in the raw URI bypass authentication and route to the package-update backend. Chained with CVE-2026-34908 (access bypass) and CVE-2026-34910 (command injection), this achieves unauthenticated root access. BishopFox confirmed the full chain end-to-end on live 5.0.6. Fixed in UniFi OS Server 5.0.8.

Tia coverage

First reported2026-06-06

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

unifi-os-critical-chain-three-cvss-10-0-vulnerabilities-enable-u

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.