Ubiquiti UniFi OS Server Unauthenticated RCE (CVE-2026-34908) | MSSP Advisory

Risk Assessment

Three chained vulnerabilities in Ubiquiti UniFi OS Server versions 5.0.6 and earlier allow an unauthenticated attacker on the network to achieve root-level remote code execution. CVE-2026-34908 and CVE-2026-34909 chain together to bypass authentication via improper access control and path traversal, then CVE-2026-34910 delivers command injection through a vulnerable endpoint. The affected service account carries passwordless sudo privileges, so privilege escalation to root requires no additional effort after initial access.

MSSPs who manage client network infrastructure through UniFi OS are not just exposing one client when this fires, they are handing an attacker administrative control over every network device, surveillance camera, and identity management system that UniFi OS governs on that deployment. If you have not pushed the 5.0.8 update to client environments and an attacker pivots through a UniFi controller you manage, you own that breach in the eyes of your client and potentially in the eyes of their legal team.