Brief Summary: CVE-2026-34909 Path Traversal in Ubiquiti UniFi OS (CVSS 10.0)

Introduction

A path traversal vulnerability in Ubiquiti's UniFi OS firmware lets an unauthenticated attacker on the network read sensitive system files and use them to hijack an underlying account. It carries the maximum CVSS score of 10.0. It is also the second CVSS 10.0 path traversal flaw disclosed in Ubiquiti products in 2026. The first, CVE-2026-22557 in the UniFi Network Application, came just two months earlier, and the pair raises questions about systemic input validation weaknesses across the UniFi software stack.

Technical Information

CVE-2026-34909 is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The vulnerability is in UniFi OS, the operating system that runs Ubiquiti's management consoles and networking appliances across a broad range of hardware platforms.

Attack Surface and Prerequisites

The attack requires only network access to the target device. According to the CVSS vector components, it needs no authentication and no user interaction, which puts it squarely in the category of unauthenticated remote exploitation. UniFi OS consoles are often the central management plane for an organization's entire network infrastructure, so a successful exploit has a large blast radius.

Root Cause

The flaw comes from improper validation of file paths in the UniFi OS web or API layer. When the application processes a request that includes a file path parameter, it does not properly sanitize or restrict directory traversal sequences. An attacker can use those sequences to escape the intended directory and access arbitrary files on the underlying Linux-based operating system.

Exploitation Flow

Based on the vendor advisory, exploitation proceeds in these stages:

1. The attacker identifies a UniFi OS device accessible on the network.
2. The attacker crafts a request containing path traversal sequences (such as ../ patterns) targeting a vulnerable endpoint on the device.
3. The device does not properly sanitize or restrict the file path, so the attacker can read files outside the intended directory.
4. The attacker accesses system files that contain or control account credentials or authentication material.
5. The attacker manipulates or uses the accessed data to compromise an underlying account on the device, which in effect gives them administrative control.

Impact

The result is a total loss of confidentiality, integrity, and availability. An attacker with administrative access to a UniFi OS console can reconfigure network infrastructure, intercept traffic, pivot to other network segments, or disable security controls entirely. Abdulaziz Almadhi of Catchify Security discovered and reported the vulnerability.

The vendor has not disclosed which files the exploit targets or exactly how the account is manipulated. Because UniFi OS is closed-source firmware, no source-level code analysis is publicly available.

Patch Information

Ubiquiti fixed CVE-2026-34909 in firmware updates released on May 21, 2026, under Security Advisory Bulletin 064. The bulletin was coordinated through HackerOne and covers this path traversal vulnerability plus four other vulnerabilities fixed in the same release cycle. The fix ships only as firmware image updates, and no source-level code diffs are publicly available.

The fixed firmware version depends on the device platform, because Ubiquiti maintains different release trains for its hardware lines:

For most products the jump from vulnerable to patched is large, for example from 5.0.16 to 5.1.12. That indicates the path traversal fix landed in the 5.1.x development branch rather than being backported to the older 5.0.x line. The exception is the standalone UniFi OS Server appliance, which got a targeted fix in 5.0.8.

Ubiquiti published a release notes page for each hardware family confirming the security fixes. Beyond patching, organizations should keep the management interfaces of UniFi OS devices strictly isolated on dedicated administrative networks to limit unauthorized network access.

Affected Systems and Versions

The vulnerability affects the entire UniFi OS device family. Products running firmware at or below the listed thresholds are vulnerable:

• UniFi OS Server: versions 5.0.6 and earlier
• UDM Beast: versions 5.1.8 and earlier
• UNAS 2, UNAS 4, UNAS Pro, UNAS Pro 4, UNAS Pro 8: versions 5.1.8 and earlier
• UNVR G2, UNVR G2 Pro: versions 5.1.11 and earlier
• UDM, UDM Pro, UDM SE, UDM Pro Max, EFG, UDW, UDR, UDR7, Express 7: versions 5.0.16 and earlier
• UNVR, UNVR Pro, UNVR Instant, ENVR: versions 5.0.16 and earlier
• UCG Ultra, UCG Max, UCG Fiber: versions 5.0.16 and earlier
• UCG Industrial: versions 5.0.13 and earlier
• UDR 5G, ENVR Core, UCKP, UCK, UCK Enterprise: versions 5.0.17 and earlier

Any UniFi OS device on a network an attacker can reach is at risk. The vulnerability requires no authentication and no user interaction.

Vendor Security History

This is the second flaw of its kind at Ubiquiti this year. In March 2026, the company issued Security Advisory Bulletin 062 to patch CVE-2026-22557, another CVSS 10.0 path traversal flaw. That one was in the UniFi Network Application, and it could also lead to account hijacking. Two maximum-severity path traversal vulnerabilities within a three-month window suggest systemic weaknesses in input validation across the UniFi software ecosystem.

To its credit, Ubiquiti has turned firmware patches around quickly and has kept a coordinated disclosure process through HackerOne. Still, organizations that rely heavily on UniFi infrastructure should pay attention to the pattern, particularly given how many device families this latest disclosure covers.

References

• CVE-2026-34909 on CVE.org
• Security Advisory Bulletin 064 (Ubiquiti Community)
• Security Advisory Bulletin 064 Discussion (Ubiquiti Community)
• Security Advisory Bulletin 064 (Reddit)
• UniFi OS Express 7 5.1.12 Release Notes
• UniFi OS Dream Machines 5.1.12 Release Notes
• UniFi OS Dream Routers 5.1.12 Release Notes
• Security Advisory Bulletin 062 (CVE-2026-22557)
• Critical Ubiquiti UniFi Security Flaw (Security Affairs)
• CVE-2026-22557 Analysis (Penligent)
• Ubiquiti (Wikipedia)