CVE-2026-34909
Overview
This vulnerability is a Path Traversal flaw (CWE-22) in Ubiquiti UniFi OS Server and related firmware components. The root cause is insufficient validation of user-supplied file path inputs, allowing traversal sequences to access files outside the intended directory scope. The affected components include UniFi OS Server and various UniFi device firmware versions that handle file requests without proper sanitization.
Vulnerability Description
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.
Impact
An attacker with network access can exploit this vulnerability without authentication to read sensitive files from the underlying operating system. This unauthorized file access may expose configuration files, credentials, or other sensitive data, potentially allowing further compromise of user accounts or system components. The breach of file system integrity can facilitate lateral movement within the network and escalate privileges, resulting in full system compromise or data exfiltration.
Solution
Ubiquiti released Security Advisory Bulletin 064 addressing this vulnerability. Users should update UniFi OS Server and all affected firmware, including UniFi Cloud Gateway Industrial, Dream Machine, Dream Machine Pro, and Dream Machine Special Edition, to the patched versions specified in the advisory. Detailed patch instructions and version information are available at https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b. Applying these updates is the recommended remediation to eliminate the path traversal issue.
EPSS vs KEV Prediction — Evolution (30 days)
Affected Products (32)
| Vendor | Product | Version | CPE | |
|---|---|---|---|---|
U
|
Ui | Unifi Os Server | All |
cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Enterprise Fortress Gateway Firmware | All |
cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Enterprise Network Video Recorder Core Firmware | All |
cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Enterprise Network Video Recorder Firmware | All |
cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unas 2 Firmware | All |
cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unas 4 Firmware | All |
cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unas Pro 4 Firmware | All |
cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unas Pro 8 Firmware | All |
cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unas Pro Firmware | All |
cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unifi Cloud Gateway Fiber Firmware | All |
cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unifi Cloud Gateway Industrial Firmware | All |
cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unifi Cloud Gateway Max Firmware | All |
cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unifi Cloud Gateway Ultra Firmware | All |
cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unifi Cloud Key Plus Firmware | All |
cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unifi Cloudkey Enterprise Firmware | All |
cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unifi Cloudkey Firmware | All |
cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unifi Dream Machine Beast Firmware | All |
cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unifi Dream Machine Firmware | All |
cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unifi Dream Machine Pro Firmware | All |
cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:*
|
|
U
|
Ui | Unifi Dream Machine Pro Max Firmware | All |
cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:*
|
Exploits
No exploits found for this CVE.
Threat Feed
17 eventsSighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
CISA confirmed active exploitation — added to Known Exploited Vulnerabilities catalog
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Likely Kill Chain
Typical exploitation path inferred from this vulnerability's characteristics — mapped to MITRE ATT&CK tactics.
Highlighted stages are those attackers typically reach when exploiting this CVE. Heuristic based on CWE families — refined by ML classifier when available.
Attack Vectors ML
MITRE ATT&CK Techniques (0)
Techniques are derived from this CVE's kill chains once ML classification completes.
CAPEC Attack Patterns ML
Red Team Playbook
Executable commands will be auto-mapped to each ATT&CK technique of this CVE.
Detection & Response Rules
No detection or response rules found for this CVE.
No news articles found for this CVE.
References (4)
| Title | Tags | URL |
|---|---|---|
| nvd.nist.gov |
NVD
reference
|
https://nvd.nist.gov/vuln/detail/CVE-2026-34909 |
| community.ui.com |
GitHub CVE
|
https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b |
| cisa.gov |
NVD API
US Government Resource
|
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34909 |
| pwndefend.com |
NVD API
Exploit
Third Party Advisory
|
https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/ |