Ubiquiti UniFi OS Critical Vulnerabilities Path Traversal RCE | MSSP Advisory

Ubiquiti patched three critical vulnerabilities in UniFi OS that allow attackers to make unauthorized system changes, access underlying system files through path traversal, and execute command injection attacks. The CVEs are 2026-34908, 2026-34909, and 2026-34910. These flaws target the management interface that controls network infrastructure across client environments.

Your clients run Ubiquiti gear everywhere and UniFi controllers sit on management VLANs with privileged network access. If attackers compromise these controllers through your remote management tools, they gain a foothold in network infrastructure that can pivot to critical systems. You need to patch these immediately and verify client patching status because compromised network gear creates persistent access that bypasses most endpoint security.

📬