CVE-2026-34910

An attacker with access to the network in which UniFi OS devices operate can send specially crafted input data to the vulnerable system component. Due to the lack of proper validation of this data, malicious data is interpreted as system commands and executed by the device. The vulnerability is remotely exploitable without the need for privileges or user engagement.

Successful exploitation of this vulnerability allows an attacker to remotely execute arbitrary system commands on the device (command injection), which may lead to complete takeover of the device, loss of confidentiality and integrity of data, and disruption of service availability.

Apply patches available from the manufacturer in accordance with the references. Detailed information about versions containing fixes is available in the Ubiquiti security bulletin at the address indicated in the references section.

Devices running UniFi OS — versions indicated in the manufacturer's references

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.