CVE-2026-34910

Confirmed PUBLISHED

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a...

Ubiquiti Inc · UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UNVR, UNVR-Pro, UNVR-Instant, UNVR-G2, UNVR-G2-Pro, ENVR, ENVR-Core, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8, UCKP, UCK, UCK-Enterprise, UCG-Ultra, UCG-Max, UCG-Fiber, UCG-Industrial

14 days faster than CISA KEV

Exploited in the wild Active exploitation observed PoC available Virtual patch available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

Unique Attacker IPs

CISA KEV

In CISA KEV

Virtual Patch

Yes 3 targets

CVSS / EPSS

10.0 Critical EPSS 78.6%

At a Glance

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

nuclei_scanner cisa

CVE Published: May 22, 2026
Exploitation Reported: Jun 09, 2026
CVSS: 10.0 Critical
EPSS: 78.6%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

31 version rows · page 2 of 2

Vendor	Product	Version	Status
Ubiquiti Inc	UCK	0 to < 5.1.12	Affected
Ubiquiti Inc	UCK-Enterprise	0 to < 5.1.12	Affected
Ubiquiti Inc	UCG-Ultra	0 to < 5.1.12	Affected
Ubiquiti Inc	UCG-Max	0 to < 5.1.12	Affected
Ubiquiti Inc	UCG-Fiber	0 to < 5.1.12	Affected
Ubiquiti Inc	UCG-Industrial	0 to < 5.1.12	Affected

CVE References

community.ui.com/releases/Security-Advisory-Bulletin-064-064/... community.ui.com · CVE Record https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/...

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
Defused Cyber First	2026-06-09 08:18 UTC
KEVIntel	2026-06-11 12:15 UTC
CISA	2026-06-23 00:00 UTC
CVE	2026-06-23 18:11 UTC
All CISA Advisories	2026-06-23 18:20 UTC
The Shadowserver	2026-07-08 00:00 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 1
Distinct User-Agents: 7

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34910.yaml	Jun 10, 2026

CVSS Scores

CVSS v3.1 10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2026-06-09 08:18:00 UTC · Defused Cyber

Active exploitation observed

Recorded 2026-06-11 12:15:26 UTC · KEVIntel sensor

Proof of concept available

Recorded 2026-06-12 14:21:15 UTC · Nuclei Templates

Weaknesses (CWE)

CWE-20

Improper Input Validation

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34910.yaml	Jun 10, 2026

Recent Mentions

CISA Adds Four Known Exploited Vulnerabilities to Catalog

All CISA Advisories · Jun 23, 2026

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-67038 Lantronix EDS5000 Code Injection Vulnerability CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

UniFi OS Server - Command Injection

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

8 Jul 2026 00:00 UTC 13 days ago

8 Jul 2026 00:00 UTC · 13 days ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
23 Jun 2026 18:20 UTC 27 days ago

23 Jun 2026 18:20 UTC · 27 days ago

KEV confirmed by All CISA Advisories

Exploitation attested by an external source
23 Jun 2026 18:11 UTC 27 days ago

23 Jun 2026 18:11 UTC · 27 days ago

KEV confirmed by CVE

Exploitation attested by an external source
23 Jun 2026 00:00 UTC 28 days ago

23 Jun 2026 00:00 UTC · 28 days ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
22 Jun 2026 14:21 UTC 28 days ago

22 Jun 2026 14:21 UTC · 28 days ago

Virtual patch available

Compensating WAF rule available to block exploitation
12 Jun 2026 14:21 UTC about 1 month ago

12 Jun 2026 14:21 UTC · about 1 month ago

Public PoC available

Public proof-of-concept code published
11 Jun 2026 12:15 UTC about 1 month ago

11 Jun 2026 12:15 UTC · about 1 month ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
11 Jun 2026 12:15 UTC about 1 month ago

11 Jun 2026 12:15 UTC · about 1 month ago

Indicators of compromise added (6)

Indicators of compromise recorded
10 Jun 2026 04:30 UTC about 1 month ago

10 Jun 2026 04:30 UTC · about 1 month ago

Nuclei template available

Scanner coverage available
9 Jun 2026 08:18 UTC about 1 month ago

9 Jun 2026 08:18 UTC · about 1 month ago

Added to KEVIntel KEV Feed

High-confidence, third-party attested exploitation
22 May 2026 00:43 UTC about 2 months ago

22 May 2026 00:43 UTC · about 2 months ago

CVE published

Vulnerability disclosed publicly
31 Mar 2026 15:00 UTC 4 months ago

31 Mar 2026 15:00 UTC · 4 months ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2026-34910

{
  "cve_id": "CVE-2026-34910",
  "title": "A malicious actor with access to the network could exploit an Improper Input ...",
  "affected_vendor": "Ubiquiti Inc",
  "affected_product": "UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UNVR, UNVR-Pro, UNVR-Instant, UNVR-G2, UNVR-G2-Pro, ENVR, ENVR-Core, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8, UCKP, UCK, UCK-Enterprise, UCG-Ultra, UCG-Max, UCG-Fiber, UCG-Industrial",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 10.0,
  "epss_score": 0.78555,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2026-34910

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 41 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

Supported Platforms

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API