CVE-2026-34909

🗓️ 22 May 2026 02:16:34Reported by [email protected]Type

A path traversal flaw in UniFi OS devices lets attackers access system files and an underlying account.

Reporter	Title	Published	Views	Family All 14
GithubExploit	Exploit for CVE-2026-34908	5 Jun 202620:28	–	githubexploit
ATTACKERKB	CVE-2026-34909	22 May 202600:43	–	attackerkb
BDU FSTEC	The vulnerability of the UniFi OS Server network management center arises from incorrect restrictions on the path to the directory, allowing unauthorized access by intruders to protected information.	4 Jun 202600:00	–	bdu_fstec
Circl	CVE-2026-34909	22 May 202607:30	–	circl
CISA KEV Catalog	Ubiquiti UniFi OS Path Traversal Vulnerability	23 Jun 202600:00	–	cisa_kev
CNNVD	Ubiquiti UniFi OS Server 安全漏洞	22 May 202600:00	–	cnnvd
CVE	CVE-2026-34909	22 May 202600:43	–	cve
Cvelist	CVE-2026-34909	22 May 202600:43	–	cvelist
EUVD	EUVD-2026-31384	22 May 202600:43	–	euvd
Positive Technologies	PT-2026-42658	21 May 202600:00	–	ptsecurity

NVD

Node

ui unifi_os_serverRange<5.0.8

Node

ui unifi_cloud_gateway_industrial_firmwareRange<5.1.12

AND

ui unifi_cloud_gateway_industrialMatch-

Node

ui unifi_dream_machine_firmwareRange<5.1.12

AND

ui unifi_dream_machineMatch-

Node

ui unifi_dream_machine_pro_firmwareRange<5.1.12

AND

ui unifi_dream_machine_proMatch-

Node

ui unifi_dream_machine_special_edition_firmwareRange<5.1.12

AND

ui unifi_dream_machine_special_editionMatch-

Node

ui unifi_dream_machine_pro_max_firmwareRange<5.1.12

AND

ui unifi_dream_machine_pro_maxMatch-

Node

ui enterprise_fortress_gateway_firmwareRange<5.1.12

AND

ui enterprise_fortress_gatewayMatch-

Node

ui unifi_dream_wall_firmwareRange<5.1.12

AND

ui unifi_dream_wallMatch-

Node

ui unifi_dream_router_firmwareRange<5.1.12

AND

ui unifi_dream_routerMatch-

Node

ui unifi_dream_router_7_firmwareRange<5.1.12

AND

ui unifi_dream_router_7Match-

Node

ui unifi_express_7_firmwareRange<5.1.12

AND

ui unifi_express_7Match-

Node

ui unifi_network_video_recorder_firmwareRange<5.1.12

AND

ui unifi_network_video_recorderMatch-

Node

ui unifi_network_video_recorder_pro_firmwareRange<5.1.12

AND

ui unifi_network_video_recorder_proMatch-

Node

ui unifi_network_video_recorder_instant_firmwareRange<5.1.12

AND

ui unifi_network_video_recorder_instantMatch-

Node

ui enterprise_network_video_recorder_firmwareRange<5.1.12

AND

ui enterprise_network_video_recorderMatch-

Node

ui unifi_cloud_gateway_ultra_firmwareRange<5.1.12

AND

ui unifi_cloud_gateway_ultraMatch-

Node

ui unifi_cloud_gateway_max_firmwareRange<5.1.12

AND

ui unifi_cloud_gateway_maxMatch-

Node

ui unifi_cloud_gateway_fiber_firmwareRange<5.1.12

AND

ui unifi_cloud_gateway_fiberMatch-

Node

ui unifi_dream_router_5g_max_firmwareRange<5.1.12

AND

ui unifi_dream_router_5g_maxMatch-

Node

ui enterprise_network_video_recorder_core_firmwareRange<5.1.12

AND

ui enterprise_network_video_recorder_coreMatch-

Node

ui unifi_cloud_key_plus_firmwareRange<5.1.12

AND

ui unifi_cloud_key_plusMatch-

Node

ui unifi_cloudkey_firmwareRange<5.1.12

AND

ui unifi_cloudkeyMatch-

Node

ui unifi_cloudkey_enterprise_firmwareRange<5.1.12

AND

ui unifi_cloudkey_enterpriseMatch-

Node

ui unifi_network_video_recorder_g2_firmwareRange<5.1.12

AND

ui unifi_network_video_recorder_g2Match-

Node

ui unifi_network_video_recorder_g2_pro_firmwareRange<5.1.12

AND

ui unifi_network_video_recorder_g2_proMatch-

Node

ui unifi_dream_machine_beast_firmwareRange<5.1.11

AND

ui unifi_dream_machine_beastMatch-

Node

ui unas_2_firmwareRange<5.1.10

AND

ui unas_2Match-

Node

ui unas_4_firmwareRange<5.1.10

AND

ui unas_4Match-

Node

ui unas_pro_firmwareRange<5.1.10

AND

ui unas_proMatch-

Node

ui unas_pro_4_firmwareRange<5.1.10

AND

ui unas_pro_4Match-

Node

ui unas_pro_8_firmwareRange<5.1.10

AND

ui unas_pro_8Match-

Node

ui unifi_express_firmwareRange<4.0.14

AND

ui unifi_expressMatch-

Source	Link
community	www.community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
pwndefend	www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/

24 Jun 2026 14:49Current

CVSS 3.110

EPSS0.02269

CWE-22