NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Ubiquiti UniFi OS: three critical flaws exploited (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910)

Attackers are using three critical UniFi OS flaws affecting Ubiquiti gateways, network controllers, video recorders and storage devices. Install the correct OS update for your model and ask your installer to check for earlier compromise.

What to do

Ask whoever manages your UniFi equipment to install the latest supported UniFi OS release for each model, meeting the fixed versions listed here. Have them check for earlier compromise as well: an installed update does not establish that an attacker or backdoor is absent.

Check your devices
  • UniFi Dream Machine (UDM)fixed in 5.1.12 and later
  • UniFi Dream Machine Pro (UDM-Pro)fixed in 5.1.12 and later
  • UniFi Dream Machine Special Edition (UDM-SE)fixed in 5.1.12 and later
  • UniFi Dream Machine Pro Max (UDM-Pro-Max)fixed in 5.1.12 and later
  • UniFi Dream Machine Beast (UDM-Beast)fixed in 5.1.11 and later
  • UniFi Dream Wall (UDW)fixed in 5.1.12 and later
  • UniFi Dream Router (UDR)fixed in 5.1.12 and later
  • UniFi Dream Router 7 (UDR7)fixed in 5.1.12 and later
  • UniFi Dream Router 5G (UDR-5G)fixed in 5.1.12 and later
  • UniFi Expressfixed in 4.0.14 and later
  • UniFi Express 7fixed in 5.1.12 and later
  • UniFi Cloud Gateway Ultra (UCG-Ultra)fixed in 5.1.12 and later
  • UniFi Cloud Gateway Max (UCG-Max)fixed in 5.1.12 and later
  • UniFi Cloud Gateway Fiber (UCG-Fiber)fixed in 5.1.12 and later
  • UniFi CloudKey (UCK)fixed in 5.1.12 and later
  • UniFi CloudKey+ (UCKP)fixed in 5.1.12 and later
  • UniFi Network Video Recorder (UNVR)fixed in 5.1.12 and later
  • UniFi Network Video Recorder Pro (UNVR-Pro)fixed in 5.1.12 and later
  • UniFi Network Video Recorder Instant (UNVR-Instant)fixed in 5.1.12 and later
  • UniFi Network Video Recorder G2 (UNVR-G2)fixed in 5.1.12 and later
  • UniFi Network Video Recorder G2 Pro (UNVR-G2-Pro)fixed in 5.1.12 and later
  • UniFi UNAS 2fixed in 5.1.10 and later
  • UniFi UNAS 4fixed in 5.1.10 and later
  • UniFi UNAS Profixed in 5.1.10 and later
  • UniFi UNAS Pro 4fixed in 5.1.10 and later
  • UniFi UNAS Pro 8fixed in 5.1.10 and later

What’s happening

Three critical flaws in Ubiquiti UniFi OS allow attackers with network access to make unauthorised system changes, read protected files that could enable account access, or run commands. They affect equipment used in homes and businesses, including Dream Machines, Dream Routers, Cloud Gateways, CloudKeys, video recorders, storage devices and UniFi OS Server. Ubiquiti published fixes in May, before CISA confirmed exploitation on 23 June. GreyNoise subsequently documented attempts on 12 and 15 June to combine the flaws and install a backdoor. Fixes are available for every product listed in the advisory, with different versions required by model. As at 3 November, the reviewed sources do not establish a total victim count or that compromised devices have been cleaned. Ransomware use is unknown.

What
Flaw
Affects
Ubiquiti UniFi OS gateways, controllers, video recorders, storage devices and UniFi OS Server
Affected
All three CVEs: UCG-Industrial, version 5.0.13 and earlier.
All three CVEs: UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max and UCG-Fiber, version 5.0.16 and earlier.
All three CVEs: UDR-5G, ENVR-Core, UCKP, UCK and UCK-Enterprise, version 5.0.17 and earlier.
All three CVEs: UniFi OS Server, version 5.0.6 and earlier.
All three CVEs: UNVR-G2 and UNVR-G2-Pro, version 5.1.11 and earlier.
All three CVEs: UDM-Beast, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8, version 5.1.8 and earlier.
CVE-2026-34909 only: Express, version 4.0.13 and earlier.
Fixed in
UniFi OS Server: 5.0.8 or later.
UCG-Industrial, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber, UDR-5G, ENVR-Core, UCKP, UCK, UCK-Enterprise, UNVR-G2 and UNVR-G2-Pro: 5.1.12 or later.
UDM-Beast: 5.1.11 or later.
UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8: 5.1.10 or later.
Express: 4.0.14 or later.
CVE
CVE-2026-34908, CVE-2026-34909, CVE-2026-34910
Since
23 June 2026
Closed
21 Sept 2026

Timeline

  1. Update

    GreyNoise published its investigation documenting the June attacks. Its UniFi findings did not provide a total victim count or confirm recovery of compromised devices.

  2. CISA added

    CISA added all three flaws to its Known Exploited Vulnerabilities catalogue, confirming their use in real attacks.

  3. Wider attacks

    GreyNoise observed another attempt by the same attacker, using a different download location for the backdoor.

  4. Wider attacks

    GreyNoise later reported an attacker attempting to combine all three flaws against unpatched UniFi devices to install a backdoor.

  5. Made publicFixed

    Ubiquiti published Bulletin 064 with fixes for three critical UniFi OS flaws: CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910. Fixed releases differ by device.

Sources

  1. Security Advisory Bulletin 064Ubiquiti · 21 May 2026
  2. Ubiquiti security advisory (AV26-498) – Update 1Canadian Centre for Cyber Security · 23 June 2026
  3. Ubiquiti patches three max severity UniFi OS vulnerabilitiesBleepingComputer · 22 May 2026
  4. Critical UniFi OS bug lets hackers gain root without authenticationBleepingComputer · 8 June 2026
  5. CISA warns of max severity Ubiquiti flaws exploited in attacksBleepingComputer · 24 June 2026
  6. Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationGreyNoise · 21 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from June 2026 · JSON · RSS