CVE-2026-34908

CVE-2026-34908 affects UniFi OS Server. The issue is an improper access control that can allow an unauthenticated bypass of the auth flow via a discrepancy between raw and normalized URIs in nginx, potentially leading to unauthorized changes and remote code execution. A fix is available: upgrade ...

CVE-2026-34910

CVE-2026-34910 affects UniFi OS Server and is triggered by an Improp er Input Validation vulnerability in UniFi OS devices, enabling an unauthenticated Command Injection over the network. The connected documentation shows that the vulnerability path leads to remote code execution with potential f...

CVE-2026-34909

CVE-2026-34909 is a path traversal vulnerability in UniFi OS devices. A network-based attacker can access files on the underlying system, potentially manipulating them to access an underlying account. The issue is rated CVSS v3.1 Base Score 10.0 (CRITICAL) with Network attack vector, no privilege...

CVE-2026-54404

UniFi OS is affected by CVE-2026-54404, which describes a series of authenticated SQL Injection vulnerabilities that allow a user with network access and low privileges to escalate privileges within UniFi OS devices or instances. The available sources confirm the issue and provide a CVSSv3.1 base...

CVE-2026-55110

Summary: CVE-2026-55110 describes a CORS misconfiguration in UniFi OS that could allow a malicious page to trigger actions in UniFi OS using an authenticated user’s session after the user visits a malicious page. Affected software/component: UniFi OS (CORS configuration issue). Root cause: CORS m...

CVE-2026-54403

The CVE-2026-54403 entry concerns a Path Traversal vulnerability in UniFi OS devices. The issue allows an attacker with network access to bypass authentication on affected UniFi OS devices/instances by exploiting path traversal. The provided sources describe the vulnerability but do not specify a...

CVE-2026-34911

Technical details about CVE-2026-34911 are not publicly available in the provided documents; monitor for updates.

CVE-2026-54401

CVE-2026-54401 describes a Server-Side Request Forgery (SSRF) in UniFi OS devices/instances that an attacker with network access and low privileges could abuse to escalate privileges. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N with a base score of 7.7 (HIGH) and high confidentiali...

CVE-2026-54402

CVE-2026-54402 describes an Improper Input Validation flaw in UniFi OS enabling a Command Injection on the host when a malicious actor with network access and low privileges interacts with the system. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) yields a base score of 9.9 (CRITICAL),...