Ubiquiti Patches Critical UniFi OS Vulnerability for Remote Privilege Escalation

Key Takeaways

• Ubiquiti has released critical security updates for its UniFi OS platform, addressing five significant vulnerabilities.
• Three of the patched flaws carry a maximum CVSS score of 10.0, enabling unauthenticated remote code execution and privilege escalation.
• A wide range of UniFi hardware, including Cloud Gateways, Dream Machines, and Network Video Recorders, are impacted.
• These vulnerabilities pose an immediate threat to internet-exposed devices, risking full network compromise.
• Administrators must apply firmware updates to UniFi OS Server, UCG, UDM, UNVR, and other affected devices to versions 5.1.12, 5.0.8, 5.1.10, or 4.0.14, depending on the model.

Ubiquiti Networks has issued an urgent series of security patches for its UniFi OS platform, addressing several highly critical vulnerabilities. These flaws could allow remote, unauthenticated attackers to execute arbitrary code, escalate privileges, and gain complete control over enterprise network infrastructure.

In total, the hardware vendor patched five distinct security issues. Alarmingly, three of these vulnerabilities boast a maximum Common Vulnerability Scoring System (CVSS v3.1) severity score of 10.0, indicating extreme risk.

The newly disclosed vulnerabilities affect a substantial number of Ubiquiti hardware appliances deployed in both corporate and prosumer environments. Impacted product lines include the UniFi Cloud Gateway (UCG) series, UniFi Dream Machine (UDM) appliances, UniFi Network Video Recorders (UNVR), and the foundational UniFi OS Server software.

Given the typical placement of these devices at the network edge, successful exploitation could grant threat actors unfettered access to internal network segments and connected endpoints. Network administrators are strongly advised to promptly assess their hardware inventory and apply the necessary firmware updates.

The severe nature of these unauthenticated command injection and path traversal bugs means that any internet-exposed management interfaces are at imminent risk. Opportunistic threat actors, botnets, and ransomware affiliates are likely to target these vulnerabilities for initial access.

UniFi OS Max Severity Flaws

Three of the vulnerabilities addressed in this update cycle are rated 10.0 on the CVSS scale, signifying zero-click, unauthenticated remote code execution capabilities.

CVE-2026-34908: Improper Access Control

The first critical flaw, identified as CVE-2026-34908, was discovered by researcher Duc Anh Nguyen (@heckintosh_). This vulnerability stems from an improper access control weakness, allowing a malicious actor with only network access to make unauthorized and extensive changes to the underlying UniFi operating system without requiring any authentication credentials.

CVE-2026-34909: Path Traversal

Equally critical is CVE-2026-34909, a path traversal vulnerability found by Abdulaziz Almadhi of Catchify Security. Exploiting this weakness enables unauthenticated attackers to navigate the file directory, read sensitive files on the host system, and manipulate them to gain unauthorized access to an underlying system account, ultimately achieving complete device compromise.

CVE-2026-34910: Improper Input Validation

The third maximum-severity bug, CVE-2026-34910, was reported by John Carroll. This vulnerability originates from improper input validation within the UniFi OS environment. Network-adjacent or remote attackers can leverage this flaw to execute arbitrary command injection, allowing them to run malicious code with system-level privileges.

High-Severity Command Injection and Exposure

In addition to the maximum-severity issues, Ubiquiti addressed two further vulnerabilities that require varying levels of prior authentication.

CVE-2026-33000: Command Injection with High Privileges

Tracked as CVE-2026-33000 and rated with a CVSS score of 9.1, this flaw permits highly privileged attackers to exploit improper input validation for command injection. Discovered by a researcher known as V3rlust, this vulnerability primarily functions as a post-compromise privilege escalation or persistence mechanism for attackers who have already breached an administrative account.

CVE-2026-34911: Path Traversal with Low Privileges

Additionally, CVE-2026-34911, discovered by Hakai Security, is a high-severity (CVSS 7.7) path traversal issue. Unlike the previously mentioned 10.0 traversal bug, this specific vulnerability requires the attacker to possess low-level privileges. Once authenticated, the attacker can navigate outside restricted directories to access sensitive system files, which could be weaponized for further lateral movement or data exfiltration across the targeted environment.

Firmware Updates

Ubiquiti has released comprehensive patches across its diverse hardware ecosystem to mitigate these severe threats. Administrators managing UCG-Industrial, UDM series, UNVR variants, and specific UCG models must upgrade their firmware to Version 5.1.12 or later.

Devices such as the UDR-5G, ENVR-Core, and UCK enterprise models also require an immediate update to Version 5.1.12.

For standalone deployments, the UniFi OS Server software must be updated to Version 5.0.8 or later. Other specific hardware appliances, including the UNAS network-attached storage series, have received patches in Version 5.1.10, while the Express models must be updated to 4.0.14.

What You Should Do

• Immediately identify all Ubiquiti UniFi OS devices within your network infrastructure.
• Refer to the official Ubiquiti security advisory for precise version requirements for each device model.
• Apply the recommended firmware updates (e.g., to versions 5.1.12, 5.0.8, 5.1.10, or 4.0.14) without delay.
• Ensure that all management interfaces for UniFi devices are strictly segregated from public internet access, ideally behind a firewall or VPN, to prevent remote exploitation.
• Regularly audit network logs for any suspicious activity indicative of attempted exploitation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.