KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-34910
10.0
3-Day Required
PoC Available
KEV
Automatable
Active Exploitation
Details
VulnerabilityUbiquiti UniFi OS Improper Input Validation Vulnerability
VendorUbiquiti
ProductUniFi OS
Date added2026-06-23
Due date2026-06-26
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-20
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Descriptions
KEV: Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.
NVD: A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
Compliance SSVC + BOD 26-04
Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required
Research metadata
Last researched2026-08-27 14:30 UTC
Wall time4.9s
Searches1
Component defaultunknown
Sources
https://nvd.nist.gov/vuln/detail/CVE-2026-34910
https://threat-modeling.com/cve-2026-34908-34909-34910-ubiquiti-unifi-os-triple-kev/
https://github.com/BishopFox/CVE-2026-34908-check
https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis
https://www.thestack.technology/ubiquiti-vulnerability-exploited-in-the-wild/
https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
https://threat-modeling.com/cve-2026-34908-34909-34910-ubiquiti-unifi-os-triple-kev/
https://github.com/BishopFox/CVE-2026-34908-check
https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis
https://www.thestack.technology/ubiquiti-vulnerability-exploited-in-the-wild/
https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
QC notes
info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)
warn component_extraction: Component 'UniFi OS package-update service pkg_name parameter (sh -c sink in uos runnable latest-versions)' matches or contains product name 'UniFi OS' — no specific component identified
Hunting hypothesis agent
Hunt nginx logs for requests reaching /ucs/update/latest_package through the validate-sso bypass, inspect pkg_name for shell metacharacters (backticks, $(), ;) — the sh -c sink for ucs-update.
Research details
ComponentUniFi OS package-update service pkg_name parameter (sh -c sink in uos runnable latest-versions)
PreconditionsNetwork reachability to UniFi OS device management interface (TCP 11443 by default); no authentication required when reached via the CVE-2026-34908/34909 auth-gateway bypass; affects UniFi OS Server <= 5.0.6 and per-model fixed versions for hardware appliances. The command injection (CVE-2026-34910) is the third link in the chain, reached after bypassing the nginx auth gateway and traversing to the package-update backend. agent
DeliveryGET request chaining auth-gateway bypass (validate-sso prefix + path traversal) to reach /proxy/users/api/v2/ucs/update/latest_package, then pkg_name parameter with shell metacharacters executed via sh -c
Public PoCyes
PoC URLs
https://github.com/BishopFox/CVE-2026-34908-check
Third-party repos; verify before use.
Exploit notesCVSS 10.0 CRITICAL | Third link in unauthenticated RCE chain: CVE-2026-34908 (access bypass) -> CVE-2026-34909 (path traversal) -> CVE-2026-34910 (command injection) | The pkg_name parameter is interpolated verbatim into `sudo /usr/bin/uos runnable latest-versions %v` and executed via sh -c with no sanitization in 5.0.6 | BishopFox confirmed: on vulnerable 5.0.6 a time-based oracle (injected sleep) produced HTTP 200 + delay; patched 5.0.8 returns HTTP 400 + no delay | Post-exploitation: ucs-update service account has passwordless sudo on /usr/bin/dpkg, /bin/chmod, /bin/systemctl, /usr/bin/uos — BishopFox proved root via sudo dpkg -i with a malicious .deb | BishopFox confirmed forged admin tokens from stolen JWT signing key survive patching | Fixed in 5.0.8: package-name allowlist, sh -c replaced with argument-array execution, sudoers hardened | Active exploitation in wild
SummaryUbiquiti UniFi OS command injection (CWE-20, CVE-2026-34910) is the third and final link in a 3-CVE unauthenticated RCE chain. The package-update service passes the pkg_name parameter to sh -c without sanitization, executing it as the ucs-update service account. Chained with CVE-2026-34908 (access bypass) and CVE-2026-34909 (path traversal), an unauthenticated attacker reaches the sink and achieves root via passwordless sudo dpkg. BishopFox confirmed full chain end-to-end on live 5.0.6 target. Fixed in UniFi OS Server 5.0.8.
Tia coverage
First reported2026-06-06
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
unifi-os-critical-chain-three-cvss-10-0-vulnerabilities-enable-u
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.