CVE-2026-34908
A critical flaw in UniFi OS devices lets attackers on the network change system settings without permission. The vulnerability can be exploited remotely and without authentication.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
UniFi OS devices, including UniFi OS Server, UniFi Cloud Gateway Industrial, UniFi Dream Machine (various firmware), Enterprise Fortress Gateway, and UniFi Dream Wall.
Real-world impact
An attacker could alter device configuration, potentially taking control of the device, disrupting network services, or enabling further attacks on connected systems.
Why this severity
The CVSS score of 10 reflects that the flaw can be exploited remotely without authentication, giving the attacker full control over confidentiality, integrity, and availability.
What to do about it
- 01Apply the vendor-provided mitigations as instructed by the vendor.
- 02Follow CISA’s BOD 26‑04 guidance for prioritizing security updates and forensics triage requirements.
- 03If mitigations are unavailable, discontinue use of the affected product.
CISA KEV required action
Timeline
- May 22, 2026 · May 22, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jun 23, 2026 · Jun 23, 2026Confirmed exploited (CISA KEV)CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
- Jun 26, 2026 · Jun 26, 2026CISA remediation deadlineFederal agencies are required to remediate by this date.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 23, 2026 · 12d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- community.ui.com/releases/Security-Advisory-…patchvendor advisory
- cisa.gov/known-exploited-vulnerabili…us government resource
- pwndefend.com/2026/06/09/cve-2026-34910-e…exploitthird party advisory