CVEFinder.io

CVE-2026-34911

⚠️ high
🔍 Scan for this CVE
Summary

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.

CVSS Score
7.7
High
EPSS Score
0.7
Exploit Probability
Published Date
2026-05-22
First Seen: 2026-05-23
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.5% of all 360,673 vulnerabilities in our database.

#113,591
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 22, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-07-23
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE IDs (Weakness Types)
CWE-22

📦 Affected Products 31

Vendor Product Status Affected Versions
ui unifi_dream_machine_firmware Affected
< 5.1.12
ui unifi_dream_machine_pro_firmware Affected
< 5.1.12
ui unifi_os_server Affected
< 5.0.8
ui enterprise_fortress_gateway_firmware Affected
< 5.1.12
ui enterprise_network_video_recorder_core_firmware Affected
< 5.1.12
ui enterprise_network_video_recorder_firmware Affected
< 5.1.12
ui unas_2_firmware Affected
< 5.1.10
ui unas_4_firmware Affected
< 5.1.10
ui unas_pro_4_firmware Affected
< 5.1.10
ui unas_pro_8_firmware Affected
< 5.1.10
ui unas_pro_firmware Affected
< 5.1.10
ui unifi_cloud_gateway_fiber_firmware Affected
< 5.1.12
ui unifi_cloud_gateway_industrial_firmware Affected
< 5.1.12
ui unifi_cloud_gateway_max_firmware Affected
< 5.1.12
ui unifi_cloud_gateway_ultra_firmware Affected
< 5.1.12
ui unifi_cloud_key_plus_firmware Affected
< 5.1.12
ui unifi_cloudkey_enterprise_firmware Affected
< 5.1.12
ui unifi_cloudkey_firmware Affected
< 5.1.12
ui unifi_dream_machine_beast_firmware Affected
< 5.1.11
ui unifi_dream_machine_pro_max_firmware Affected
< 5.1.12
ui unifi_dream_machine_special_edition_firmware Affected
< 5.1.12
ui unifi_dream_router_7_firmware Affected
< 5.1.12
ui unifi_dream_router_firmware Affected
< 5.1.12
ui unifi_dream_wall_firmware Affected
< 5.1.12
ui unifi_express_7_firmware Affected
< 5.1.12
ui unifi_network_video_recorder_firmware Affected
< 5.1.12
ui unifi_network_video_recorder_g2_firmware Affected
< 5.1.12
ui unifi_network_video_recorder_g2_pro_firmware Affected
< 5.1.12
ui unifi_network_video_recorder_instant_firmware Affected
< 5.1.12
ui unifi_network_video_recorder_pro_firmware Affected
< 5.1.12
ui unifi_dream_router_5g_max_firmware Affected
< 5.1.12

🔗 References 1

https://community.ui.com/releases/Security-Advisory-...
Patch Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-54401 ⚠️ high 7.7 0.2 A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to es... 2026-07-02
CVE-2026-54402 ⛔ critical 9.9 0.9 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability... 2026-07-02
CVE-2026-54403 ⚠️ high 8.6 0.5 A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices runni... 2026-07-02
CVE-2026-54404 ⚠️ high 8.8 0.3 A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vu... 2026-07-02
CVE-2026-55110 ⚠️ high 7.5 0.1 A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (COR... 2026-07-02
CVE-2026-55112 ⚠️ high 7.5 0.2 A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper A... 2026-07-02
These CVEs affect the same products