{"id":"ubiquiti-unifi-os-exploited-jun-2026","category":"patch","status":"closed","title":"Ubiquiti UniFi OS: three critical flaws exploited (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910)","tldr":"Attackers are using three critical UniFi OS flaws affecting Ubiquiti gateways, network controllers, video recorders and storage devices. Install the correct OS update for your model and ask your installer to check for earlier compromise.","summary":"Three critical flaws in Ubiquiti UniFi OS allow attackers with network access to make unauthorised system changes, read protected files that could enable account access, or run commands. They affect equipment used in homes and businesses, including Dream Machines, Dream Routers, Cloud Gateways, CloudKeys, video recorders, storage devices and UniFi OS Server. Ubiquiti published fixes in May, before CISA confirmed exploitation on 23 June. GreyNoise subsequently documented attempts on 12 and 15 June to combine the flaws and install a backdoor. Fixes are available for every product listed in the advisory, with different versions required by model. As at 3 November, the reviewed sources do not establish a total victim count or that compromised devices have been cleaned. Ransomware use is unknown.","action":"Ask whoever manages your UniFi equipment to install the latest supported UniFi OS release for each model, meeting the fixed versions listed here. Have them check for earlier compromise as well: an installed update does not establish that an attacker or backdoor is absent.","product":"Ubiquiti UniFi OS gateways, controllers, video recorders, storage devices and UniFi OS Server","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-34908","CVE-2026-34909","CVE-2026-34910"],"tags":["ubiquiti","unifi","router","nas","actively-exploited","command-injection"],"affected":["All three CVEs: UCG-Industrial, version 5.0.13 and earlier.","All three CVEs: UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max and UCG-Fiber, version 5.0.16 and earlier.","All three CVEs: UDR-5G, ENVR-Core, UCKP, UCK and UCK-Enterprise, version 5.0.17 and earlier.","All three CVEs: UniFi OS Server, version 5.0.6 and earlier.","All three CVEs: UNVR-G2 and UNVR-G2-Pro, version 5.1.11 and earlier.","All three CVEs: UDM-Beast, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8, version 5.1.8 and earlier.","CVE-2026-34909 only: Express, version 4.0.13 and earlier."],"fixed":["UniFi OS Server: 5.0.8 or later.","UCG-Industrial, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber, UDR-5G, ENVR-Core, UCKP, UCK, UCK-Enterprise, UNVR-G2 and UNVR-G2-Pro: 5.1.12 or later.","UDM-Beast: 5.1.11 or later.","UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8: 5.1.10 or later.","Express: 4.0.14 or later."],"matches":[{"platform":"router","app":"UniFi Dream Machine (UDM)","bundle":"","fixed":"5.1.12"},{"platform":"router","app":"UniFi Dream Machine Pro (UDM-Pro)","bundle":"","fixed":"5.1.12"},{"platform":"router","app":"UniFi Dream Machine Special Edition (UDM-SE)","bundle":"","fixed":"5.1.12"},{"platform":"router","app":"UniFi Dream Machine Pro Max (UDM-Pro-Max)","bundle":"","fixed":"5.1.12"},{"platform":"router","app":"UniFi Dream Machine Beast (UDM-Beast)","bundle":"","fixed":"5.1.11"},{"platform":"router","app":"UniFi Dream Wall (UDW)","bundle":"","fixed":"5.1.12"},{"platform":"router","app":"UniFi Dream Router (UDR)","bundle":"","fixed":"5.1.12"},{"platform":"router","app":"UniFi Dream Router 7 (UDR7)","bundle":"","fixed":"5.1.12"},{"platform":"router","app":"UniFi Dream Router 5G (UDR-5G)","bundle":"","fixed":"5.1.12"},{"platform":"router","app":"UniFi Express","bundle":"","fixed":"4.0.14"},{"platform":"router","app":"UniFi Express 7","bundle":"","fixed":"5.1.12"},{"platform":"router","app":"UniFi Cloud Gateway Ultra (UCG-Ultra)","bundle":"","fixed":"5.1.12"},{"platform":"router","app":"UniFi Cloud Gateway Max (UCG-Max)","bundle":"","fixed":"5.1.12"},{"platform":"router","app":"UniFi Cloud Gateway Fiber (UCG-Fiber)","bundle":"","fixed":"5.1.12"},{"platform":"other","app":"UniFi CloudKey (UCK)","bundle":"","fixed":"5.1.12"},{"platform":"other","app":"UniFi CloudKey+ (UCKP)","bundle":"","fixed":"5.1.12"},{"platform":"other","app":"UniFi Network Video Recorder (UNVR)","bundle":"","fixed":"5.1.12"},{"platform":"other","app":"UniFi Network Video Recorder Pro (UNVR-Pro)","bundle":"","fixed":"5.1.12"},{"platform":"other","app":"UniFi Network Video Recorder Instant (UNVR-Instant)","bundle":"","fixed":"5.1.12"},{"platform":"other","app":"UniFi Network Video Recorder G2 (UNVR-G2)","bundle":"","fixed":"5.1.12"},{"platform":"other","app":"UniFi Network Video Recorder G2 Pro (UNVR-G2-Pro)","bundle":"","fixed":"5.1.12"},{"platform":"nas","app":"UniFi UNAS 2","bundle":"","fixed":"5.1.10"},{"platform":"nas","app":"UniFi UNAS 4","bundle":"","fixed":"5.1.10"},{"platform":"nas","app":"UniFi UNAS Pro","bundle":"","fixed":"5.1.10"},{"platform":"nas","app":"UniFi UNAS Pro 4","bundle":"","fixed":"5.1.10"},{"platform":"nas","app":"UniFi UNAS Pro 8","bundle":"","fixed":"5.1.10"}],"sources":[{"kind":"advisory","title":"Security Advisory Bulletin 064","url":"https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b","by":"Ubiquiti","date":"2026-05-21"},{"kind":"advisory","title":"Ubiquiti security advisory (AV26-498) – Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/ubiquiti-security-advisory-av26-498","by":"Canadian Centre for Cyber Security","date":"2026-06-23"},{"kind":"news","title":"Ubiquiti patches three max severity UniFi OS vulnerabilities","url":"https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-unifi-os-vulnerabilities/","by":"BleepingComputer","date":"2026-05-22"},{"kind":"news","title":"Critical UniFi OS bug lets hackers gain root without authentication","url":"https://www.bleepingcomputer.com/news/security/critical-unifi-os-bug-lets-hackers-gain-root-without-authentication/","by":"BleepingComputer","date":"2026-06-08"},{"kind":"news","title":"CISA warns of max severity Ubiquiti flaws exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-max-severity-ubiquiti-flaws-exploited-in-attacks/","by":"BleepingComputer","date":"2026-06-24"},{"kind":"research","title":"Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation","url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","by":"GreyNoise","date":"2026-09-21"}],"started":"2026-06-23","closed":"2026-09-21","created":"2026-11-03T22:19:48.631Z","updated":"2026-11-03T22:19:48.631Z","cve_notes":[{"cve":"CVE-2026-34908","name":"Access control bypass in Ubiquiti UniFi OS","what":"Faulty access controls in UniFi OS let an attacker with network access make unauthorised changes to the system.","severity":"critical","cvss":10},{"cve":"CVE-2026-34909","name":"Protected file access in Ubiquiti UniFi OS","what":"A path traversal flaw in UniFi OS lets an attacker with network access reach protected system files that could be manipulated to gain access to an underlying account.","severity":"critical","cvss":10},{"cve":"CVE-2026-34910","name":"Command injection in Ubiquiti UniFi OS","what":"Insufficient input checks in UniFi OS let an attacker with network access inject operating system commands.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-09-21","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"GreyNoise published its investigation documenting the June attacks. Its UniFi findings did not provide a total victim count or confirm recovery of compromised devices.","url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","by":"GreyNoise","patch":null},{"at":"2026-06-23","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added all three flaws to its Known Exploited Vulnerabilities catalogue, confirming their use in real attacks.","url":"https://www.cyber.gc.ca/en/alerts-advisories/ubiquiti-security-advisory-av26-498","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-06-15","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"GreyNoise observed another attempt by the same attacker, using a different download location for the backdoor.","url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","by":"GreyNoise","patch":null},{"at":"2026-06-12","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"GreyNoise later reported an attacker attempting to combine all three flaws against unpatched UniFi devices to install a backdoor.","url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","by":"GreyNoise","patch":null},{"at":"2026-05-21","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Ubiquiti published Bulletin 064 with fixes for three critical UniFi OS flaws: CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910. Fixed releases differ by device.","url":"https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b","by":"Ubiquiti","patch":"patched"}],"url":"https://hard.fyi/live/ubiquiti-unifi-os-exploited-jun-2026/","json":"https://hard.fyi/api/live?id=ubiquiti-unifi-os-exploited-jun-2026"}