CVE-2026-34910 is an improper-input-validation flaw (CWE-20) in Ubiquiti UniFi OS that lets an attacker with network access inject OS commands through the package-update service. You are affected if you run UniFi OS Server below 5.0.8, or a UniFi gateway, Cloud Key, NVR or UNAS console on UniFi OS firmware below 5.1.12 (5.1.10 or 5.1.11 on a few models). CISA lists it as exploited in the wild.
Vulnerability summary
CVSS base score
10
Critical severity
EPSS score (FIRST)
90.0%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2026-34910 · Source: NVD (HackerOne-submitted Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Ubiquiti UniFi OS Server (software) | cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:* | Before 5.0.8 |
| Ubiquiti UniFi OS device firmware (UDM/UDR/UCG/UniFi Express/UniFi Cloud Gateway, Network Video Recorder, Cloud Key and UNAS families) | cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:* | Before 5.1.12 on most models per NVD CPE data; a few models (e.g. UNAS 2/4/Pro/Pro-4/Pro-8, UniFi Dream Machine Beast) were fixed one or two point releases earlier (5.1.10/5.1.11) |
What does this mean for affected devices?
CVE-2026-34910 is an improper input validation weakness (CWE-20) in UniFi OS, the Linux-based firmware that runs Ubiquiti's UniFi gateways, consoles and video recorders. NVD's description reads: "A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection" (NVD). Ubiquiti disclosed it in Security Advisory Bulletin 064 together with CVE-2026-34908 (improper access control) and CVE-2026-34909 (path traversal).
Affected and fixed versions. NVD's CPE data, last modified on 23 July 2026, lists UniFi OS Server before 5.0.8 and UniFi OS device firmware before 5.1.12 on the UniFi Dream Machine, Dream Router, Dream Wall, Express 7, Cloud Gateway (Ultra, Max, Fiber, Industrial), Enterprise Fortress Gateway, Cloud Key, and the UniFi and Enterprise Network Video Recorder families. The UniFi Dream Machine Beast is fixed in 5.1.11, and the UNAS 2, UNAS 4, UNAS Pro, UNAS Pro 4 and UNAS Pro 8 in 5.1.10 (NVD).
Score. As of 14 November 2026, NVD's status for the record is Analyzed, and the only CVSS metric on file is the Secondary CVSS v3.1 score of 10.0 (critical) submitted through HackerOne, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. NVD lists no Primary metric of its own, so this page shows the 10.0 as a CNA score (NVD).
Exploitation. CISA added CVE-2026-34910, CVE-2026-34908 and CVE-2026-34909 to the Known Exploited Vulnerabilities catalog on 23 June 2026, with a remediation due date of 26 June 2026; the catalog lists known ransomware use as Unknown (CISA KEV). A technical write-up by PwnDefend describes the chain seen in the wild: an encoded path traversal in an /api/auth/validate-sso/ request reaches the local package-update endpoint without credentials, and shell metacharacters in its pkg_name parameter run under /bin/sh. The dropped loader, zok, fetches a Mirai/Gafgyt-derived implant named azsxd built for 14 CPU architectures (PwnDefend). As of 13 November 2026, FIRST EPSS scores the CVE at 0.90032, the 99.798th percentile (FIRST EPSS).
What to do. Operators should update every UniFi OS console and UniFi OS Server install to the fixed builds above, take management interfaces off the internet, and check for the indicators PwnDefend publishes (requests to validate-sso paths containing ..%2f, processes running from deleted binaries, files named azsxd.*). Device makers who ship a Linux-based management plane should treat this as a reminder that an updater which passes a request parameter to a shell is a remote code execution path. SoftWSP extracts a CycloneDX 1.6 SBOM from a firmware image and matches its components against NVD, CISA KEV and FIRST EPSS, so a KEV-listed component like this one is flagged in an AI-drafted, cited report for engineer review.
Evidence
- UniFi OS devices contain an improper-input-validation flaw (CWE-20) letting a network-positioned attacker execute command injection. — NVD
- Ubiquiti disclosed CVE-2026-34910 with CVE-2026-34908 and CVE-2026-34909 in Security Advisory Bulletin 064. — Ubiquiti Security Advisory Bulletin 064
- UniFi OS Server fixed in 5.0.8; UniFi OS device firmware fixed in 5.1.12, UniFi Dream Machine Beast in 5.1.11, UNAS 2/4/Pro/Pro 4/Pro 8 in 5.1.10. — NVD
- As of 14 November 2026 NVD status is Analyzed; only a Secondary CVSS v3.1 10.0 score submitted via HackerOne, no NVD Primary metric. — NVD
- Added to the CISA KEV catalog on 23 June 2026, due date 26 June 2026; known ransomware use Unknown. — CISA KEV catalog
- In-the-wild chain: encoded path traversal via /api/auth/validate-sso/ to the package-update endpoint, pkg_name command injection, zok loader and azsxd Mirai/Gafgyt-derived implant with 14 architecture variants. — PwnDefend
- EPSS score 0.90032 (99.798th percentile) as of 13 November 2026. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
Which UniFi devices are affected by CVE-2026-34910?
Per NVD's CPE data, UniFi OS device firmware before 5.1.12 on the UniFi Dream Machine and Dream Router families, Dream Wall, Express 7, Cloud Gateway Ultra, Max, Fiber and Industrial, Enterprise Fortress Gateway, Cloud Key models and the UniFi and Enterprise Network Video Recorder families. The UniFi Dream Machine Beast is fixed in 5.1.11 and the UNAS models in 5.1.10; UniFi OS Server is fixed in 5.0.8.
Is CVE-2026-34910 exploited in the wild?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 23 June 2026, together with CVE-2026-34908 and CVE-2026-34909. PwnDefend documents attackers chaining the access-control bypass with this command injection to drop a Mirai/Gafgyt-derived botnet implant.
Why does this page show a CVSS score of 10.0 if NVD has no Primary score?
As of 14 November 2026, NVD's record is Analyzed but carries only the Secondary CVSS v3.1 score of 10.0 submitted through HackerOne. The page shows that CNA score and labels it as such; the KEV listing is what places the CVE in the confirmed-exploited group.
How can I tell whether a UniFi console was compromised?
PwnDefend lists three signals: requests to /api/auth/validate-sso/ paths containing encoded ..%2f traversal, processes running from deleted binaries, and files named zok or azsxd.* on the device. A console that shows any of them should be rebuilt from fixed firmware, not only updated.
Questions about this page?