CVE-2026-34908

Ubiquiti · Published May 22, 2026

10.0

CVSS v3.1

CRITICAL

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

Affected Products

Unifi OS Server < 5.0.8
Unifi Cloud Gateway Industrial Firmware < 5.1.12
Unifi Dream Machine Firmware < 5.1.12
Unifi Dream Machine PRO Firmware < 5.1.12

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H