Reported by 3 outlets
UniFi OS Critical Chain — Three CVSS 10.0 Vulnerabilities Enable Unauthenticated Root RCE on Network Management Appliances
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Ubiquiti's Security Advisory Bulletin 064, published May 21, 2026, lists five CVEs across the UniFi OS family. The three that matter most chain into unauthenticated root RCE: CVE-2026-34908 and CVE-2026-34909, both CVSS 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, abuse the gap between Nginx's raw request URI and its normalized form, riding the auth-exempt /api/auth/validate-sso/ prefix into authenticated proxy routes. CVE-2026-34910, also 10.0, is command injection in the package-update service, where an attacker-controlled package name reaches sh -c unvalidated. UniFi OS Server 5.0.6 and earlier are affected and 5.0.8, built on unifi-core 5.0.153, closes the chain. Bishop Fox validated the whole sequence end to end on 5.0.6 on June 5, 2026: one crafted HTTP request, root shell, no credentials.
Timing is the argument. The vendor shipped fixes on May 21; what is new since June 5 is a weaponization writeup with a working root-shell demonstration and a detection tool, so every unpatched console already sits behind an exploit curve that started more than two weeks ago. The advisory thread shows about 130,000 views, yet the story's first news pickup came June 6 through a single outlet, which means defenders are hearing about this late and from thin coverage. Exposure is the management plane itself: TCP 11443 on UniFi OS Server plus the broad hardware list in the same advisory (UDM, UDR, UNVR, UNAS, Cloud Gateways, Express), each with its own fixed version. Root reads the JWT signing key at /data/unifi-core/config/jwt.yaml, and Bishop Fox confirmed forged owner-scope tokens still authenticate against fully patched 5.0.8 consoles, so patching alone leaves stolen-key admin access alive. This is also the second CVSS 10.0 in the UniFi ecosystem from the same firm inside a month, following CVE-2026-22557 in UniFi Network Application on May 29. The platform is under sustained offensive research attention, and a validated chain like this gets reused, not retired.
Patch UniFi OS Server to 5.0.8 or later; hardware lines move to 5.1.12 for the UDM, UDR, UNVR and Cloud Gateway families, 5.1.10 for UNAS, 5.1.11 for Dream Machine Beast, and 4.0.14 for Express. Until patched, restrict TCP 11443 to a management VLAN and treat internet or guest-network reachability as critical. Hunt the entry signature in front-end logs: request URIs combining /api/auth/validate-sso/ with encoded traversal such as ..%2f, ..%2e or %2e%2e, and calls to the .../ucs/update/latest_package route carrying shell metacharacters. On host, alert on unexpected child processes and passwordless sudo use of dpkg, chmod, systemctl or uos under the ucs-update account. Bishop Fox's CVE-2026-34908-check tool returns a vulnerable-or-patched verdict without executing anything on the target. Any console reachable before patching is compromised until proven otherwise: rotate the JWT signing key, which requires a reboot to take effect, plus TLS keys, cloud tokens and database credentials, then rebuild from a known-good image, because a forged owner token can enable SSH and set a root password that survives key rotation.
Two developments would change this assessment. Public exploit code or scanning telemetry against TCP 11443 for CVE-2026-34910 or its authenticated sibling CVE-2026-33000 would turn an exposure-management problem into fleet-wide incident response. And any vendor follow-up on the residual root-capable passwordless sudo grant Bishop Fox found on a second service account after the 5.0.8 sudoers hardening would show whether the over-privileged-service-account pattern keeps producing UniFi OS chains.
Timeline
-
original reporting
UniFi OS Critical Chain — Three CVSS 10.0 Vulnerabilities Enable Unauthenticated Root RCE on Network Management Appliances
cyberpress.org · 130d ago · June 6th, 2026
Ubiquiti patched three critical vulnerabilities in UniFi OS Server that chain together to deliver unauthenticated remote code execution with root privileges. Bishop Fox confirmed the full exploit chain end-to-end on version 5.0.6 — a single crafted HTTP request yields a root shell, no credentials, no user interaction.
The chain:
-
CVE-2026-34908 / CVE-2026-34909 (CVSS 10.0 each) — Authentication gateway bypass via URI normalization mismatch. Nginx reads the raw
$request_urifor auth decisions but passes the normalized$uri(where%2fdecodes to/) to upstream backends. Attackers craft a request whose raw form starts with the auth-exempt/api/auth/validate-sso/prefix passing the gate, while its normalized form hits authenticated proxy routes. -
CVE-2026-34910 (CVSS 10.0) — Command injection in the package-update service. The handler shells out the attacker-controlled package name via
fmt.Sprintfintosh -c. No validation on the package name means shell metacharacters are interpreted directly. Theucs-updateaccount holds passwordless sudo rights overdpkg,chmod,systemctl, anduos— enabling installation of a crafted.debwhose post-install script runs as root.
Worse than a single patch: Root on a UniFi OS Server means full management-plane compromise: the JWT signing key can be read and forged admin sessions minted offline. Bishop Fox confirmed that a forged owner-scope JWT token authenticated successfully against both vulnerable 5.0.6 and fully patched 5.0.8 consoles. Any signing key stolen before patching continues to generate valid admin sessions indefinitely. In deployments with UniFi Access and UniFi Protect, the same position unlocks physical doors, clones NFC/face credentials, views live camera feeds, and deletes recorded surveillance footage.
Action: Patch to UniFi OS Server 5.0.8 or hardware-equivalent fixed version. Restrict TCP 11443 to a dedicated management VLAN. Treat any instance exposed before patching as fully compromised — rotate JWT signing key (
/data/unifi-core/config/jwt.yaml), TLS keys, cloud tokens, and database credentials. Rebuild from known-good image. Biometric and NFC data cannot be rotated — treat as permanently disclosed. -
-
update from community.ui.com
Security Advisory Bulletin 064
community.ui.com · 146d ago · May 21st, 2026
Ubiquiti's advisory, published May 21, 2026 and updated to version 1.1 on May 22, 2026, covers five CVEs across the UniFi OS family: CVE-2026-33000 (CVSS 9.1), CVE-2026-34908 and CVE-2026-34909 (both CVSS 10.0), CVE-2026-34910 (CVSS 10.0), and CVE-2026-34911 (CVSS 7.7). It lists UniFi OS Server 5.0.6 and earlier as affected, fixes in 5.0.8, and gives per-product fixed versions across the hardware lineup (5.1.12 for most gateways and recorders, 5.1.10 for UNAS, 5.1.11 for UDM-Beast, 4.0.14 for Express). Credited researchers include Duc Anh Nguyen, Abdulaziz Almadhi of Catchify Security, John Carroll, V3rlust, and Hakai Security.
-
update from bishopfox.com
Looting UniFi Controllers: Detecting and Weaponizing CVE-2026-22557
bishopfox.com · 138d ago · May 29th, 2026
A week before the UniFi OS Server chain writeup, Bishop Fox published analysis of CVE-2026-22557, a CVSS 10.0 unauthenticated path traversal in UniFi Network Application that exposes controller backups and the credentials of every managed device. The post covers a separate CVE from SAB-064 but is the second CVSS 10.0 in the UniFi ecosystem the same firm disclosed within two weeks.
-
update from bishopfox.com
Popping Root on UniFi OS Server: Unauthenticated RCE Chain Detection & Analysis
bishopfox.com · 131d ago · June 5th, 2026
The post confirms forged HS256 owner tokens built from the signing key at /data/unifi-core/config/jwt.yaml still authenticate against fully patched 5.0.8 consoles, and publishes a safe detection tool, CVE-2026-34908-check, on GitHub.