CVSS 3.1
10.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCVE-2026-34909
Critical (10.0) in Ubiquiti UniFi OS. In CISA KEV since 2026-06-23. EPSS 68% chance of exploitation in the next 30 days.
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.
Severity
- EPSS
- 68% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2026-06-23, due 2026-06-26
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ui:enterprise_fortress_gateway_firmware
- ui:enterprise_network_video_recorder_core_firmware
- ui:enterprise_network_video_recorder_firmware
- ui:unas_2_firmware
- ui:unas_4_firmware
- ui:unas_pro_4_firmware
- ui:unas_pro_8_firmware
- ui:unas_pro_firmware
- ui:unifi_cloud_gateway_fiber_firmware
- ui:unifi_cloud_gateway_industrial_firmware
- ui:unifi_cloud_gateway_max_firmware
- ui:unifi_cloud_gateway_ultra_firmware
- ui:unifi_cloud_key_plus_firmware
- ui:unifi_cloudkey_enterprise_firmware
- ui:unifi_cloudkey_firmware
- ui:unifi_dream_machine_beast_firmware
- ui:unifi_dream_machine_firmware
- ui:unifi_dream_machine_pro_firmware
- ui:unifi_dream_machine_pro_max_firmware
- ui:unifi_dream_machine_special_edition_firmware
- ui:unifi_dream_router_5g_max_firmware
- ui:unifi_dream_router_7_firmware
- ui:unifi_dream_router_firmware
- ui:unifi_dream_wall_firmware
- ui:unifi_express_7_firmware
- ui:unifi_express_firmware
- ui:unifi_network_video_recorder_firmware
- ui:unifi_network_video_recorder_g2_firmware
- ui:unifi_network_video_recorder_g2_pro_firmware
- ui:unifi_network_video_recorder_instant_firmware
- ui:unifi_network_video_recorder_pro_firmware
- ui:unifi_os_server