CVEFinder.io

CVE-2026-34908

⛔ critical
🔍 Scan for this CVE
Summary

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

CVSS Score
10.0
Critical
EPSS Score
58.4
Exploit Probability
Published Date
2026-05-22
First Seen: 2026-05-23
📊 Relative Risk Intelligence

This CVE is Extremely High Risk - more severe than 100.0% of all 360,673 vulnerabilities in our database.

#1
Top 5% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 22, 2026
🔍 Exploitation Status
Active
Exploits detected in the wild
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-07-23
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-284

📦 Affected Products 31

Vendor Product Status Affected Versions
ui unifi_dream_machine_firmware Affected
< 5.1.12
ui unifi_dream_machine_pro_firmware Affected
< 5.1.12
ui unifi_os_server Affected
< 5.0.8
ui enterprise_fortress_gateway_firmware Affected
< 5.1.12
ui enterprise_network_video_recorder_core_firmware Affected
< 5.1.12
ui enterprise_network_video_recorder_firmware Affected
< 5.1.12
ui unas_2_firmware Affected
< 5.1.10
ui unas_4_firmware Affected
< 5.1.10
ui unas_pro_4_firmware Affected
< 5.1.10
ui unas_pro_8_firmware Affected
< 5.1.10
ui unas_pro_firmware Affected
< 5.1.10
ui unifi_cloud_gateway_fiber_firmware Affected
< 5.1.12
ui unifi_cloud_gateway_industrial_firmware Affected
< 5.1.12
ui unifi_cloud_gateway_max_firmware Affected
< 5.1.12
ui unifi_cloud_gateway_ultra_firmware Affected
< 5.1.12
ui unifi_cloud_key_plus_firmware Affected
< 5.1.12
ui unifi_cloudkey_enterprise_firmware Affected
< 5.1.12
ui unifi_cloudkey_firmware Affected
< 5.1.12
ui unifi_dream_machine_beast_firmware Affected
< 5.1.11
ui unifi_dream_machine_pro_max_firmware Affected
< 5.1.12
ui unifi_dream_machine_special_edition_firmware Affected
< 5.1.12
ui unifi_dream_router_7_firmware Affected
< 5.1.12
ui unifi_dream_router_firmware Affected
< 5.1.12
ui unifi_dream_wall_firmware Affected
< 5.1.12
ui unifi_express_7_firmware Affected
< 5.1.12
ui unifi_network_video_recorder_firmware Affected
< 5.1.12
ui unifi_network_video_recorder_g2_firmware Affected
< 5.1.12
ui unifi_network_video_recorder_g2_pro_firmware Affected
< 5.1.12
ui unifi_network_video_recorder_instant_firmware Affected
< 5.1.12
ui unifi_network_video_recorder_pro_firmware Affected
< 5.1.12
ui unifi_dream_router_5g_max_firmware Affected
< 5.1.12

🔗 References 3

https://community.ui.com/releases/Security-Advisory-...
Patch Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities...
US Government Resource
https://www.pwndefend.com/2026/06/09/cve-2026-34910-...
Exploit Third Party Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-54401 ⚠️ high 7.7 0.2 A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to es... 2026-07-02
CVE-2026-54402 ⛔ critical 9.9 0.9 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability... 2026-07-02
CVE-2026-54403 ⚠️ high 8.6 0.5 A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices runni... 2026-07-02
CVE-2026-54404 ⚠️ high 8.8 0.3 A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vu... 2026-07-02
CVE-2026-55110 ⚠️ high 7.5 0.1 A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (COR... 2026-07-02
CVE-2026-55112 ⚠️ high 7.5 0.2 A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper A... 2026-07-02
These CVEs affect the same products