Network and security components continue to be the focus of professional threat actors. Currently, security researchers, the manufacturer Ubiquiti and the US cybersecurity agency CISA warn of three critical vulnerabilities in UniFi OS that are already being actively exploited. Companies using UniFi devices should install the security updates provided in a timely manner and check their systems for signs of compromise.
What happened?
UniFi OS is the central operating system and management platform of many Ubiquiti devices. Among other things, firewalls, routers, gateways, Wi-Fi networks, switches and video surveillance systems are centrally managed and configured. Since UniFi OS can be used to administer the entire network infrastructure, the platform is a particularly attractive point of attack for cybercriminals.
Three critical vulnerabilities (CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910) have been discovered in UniFi OS with a maximum CVSS score of 10.0. It is particularly critical that these vulnerabilities can be combined with each other and thus enable a complete takeover of affected systems.
The U.S. cybersecurity agency CISA has already included the vulnerabilities in its catalog of actively exploited vulnerabilities. In addition, a functional sample exploit has been published by security researchers, which significantly increases the risk of further attacks.
How does the attack work?
The attack targets the UniFi OS management interface. By exploiting these three vulnerabilities in combination, attackers can bypass several security mechanisms in succession. First, they gain access to internal system functions without having to authenticate using valid credentials (authentication bypass). They can then access confidential system files (path traversal) and, finally, execute arbitrary commands on the device (command injection).
As a result, the attackers gain full control over the management infrastructure of the affected UniFi system – with the highest system privileges (remote root compromise). This means that they can take complete control of the system without having to log in first. They can then manage the device as an administrator, create new user accounts, change configurations or manipulate security features.
Attacks that have already been observed show that attackers create new administrator accounts – for example, with the name ‘John Sim’ – without being detected. Such accounts enable them to remain on the system indefinitely and prepare further attacks on internal systems.
What is affected?
The following systems with UniFi OS are affected, among others:
Small and medium-sized companies in particular often use UniFi products as a central network and security infrastructure.
Why is this particularly critical?
UniFi gateways and controllers often manage an organization’s entire network infrastructure. If such a system is compromised, attackers can create new user accounts, change network configurations, override security mechanisms or attack other systems within the company network, among other things.
Since the vulnerabilities are already being actively exploited and publicly available attack tools exist, there is a particularly high risk for unpatched systems. The combination of ease of exploitability, lack of exploit barriers, and already confirmed active exploitation makes these vulnerabilities particularly attractive for automated attacks, botnets, and large-scale campaigns.
How can I protect myself?
We recommend that affected companies implement the following measures in a timely manner:
Companies using UniFi OS should update their systems at short notice and check for signs of compromise as a precautionary measure.
Do you want to stay informed about current threats and security vulnerabilities?
Subscribe to our newsletter and receive important warnings, recommendations for action and assessments of current cyber risks directly in your inbox.
Sources & Further Information