Introduction
Three CVSS 10.0 vulnerabilities landing in a single vendor advisory is uncommon, and when the affected platform is Ubiquiti's UniFi OS, the blast radius spans enterprise networks, small businesses, and home labs alike. CVE-2026-34910 is one of those three critical flaws. It is an unauthenticated command injection that gives a network-adjacent attacker arbitrary command execution on any unpatched UniFi OS device.
Ubiquiti sells widely deployed networking equipment under its UniFi brand, including routers, switches, access points, network video recorders, and NAS devices. UniFi OS is the embedded operating system on these devices, and it runs across a broad hardware portfolio. The platform is popular in both SMB and enterprise environments, so the scope of this vulnerability is significant.
Technical Information
CVE-2026-34910 is an improper input validation flaw, classified under CWE-20. It exists in UniFi OS, the embedded operating system that runs across Ubiquiti's hardware product lines, including cloud gateways, dream machines, network video recorders, and NAS devices.
User-supplied input that reaches the UniFi OS device over the network is not properly sanitized before it is passed to a system command execution context. An attacker can craft a malicious payload that escapes the intended input boundary and injects arbitrary operating system commands. Those commands execute at the privilege level of the vulnerable service on the device.
The attack surface is network reachable. The official NVD description reads: "A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection." Community security alerts tied to Bulletin 064 warn of unauthenticated remote code execution, which means no credentials are required to exploit the flaw.
Attack Flow
From the available information, exploitation follows this general pattern:
- The attacker identifies a network-reachable UniFi OS device running a vulnerable firmware version.
- The attacker sends a crafted request containing a command injection payload to the vulnerable input handling component.
- Because input validation is insufficient, the device interprets and executes the payload as an operating system command.
- The attacker achieves arbitrary command execution and may gain full control of the device.
The CVSS 10.0 score reflects network accessibility, no authentication requirement, and complete compromise of confidentiality, integrity, and availability.
A Note on Source Discrepancies
One secondary community summary describes CVE-2026-34910 as a path traversal vulnerability requiring low privileges. This appears to be a misattribution. OpenCVE data lists CVE-2026-34909 as the path traversal issue, and the NVD description for CVE-2026-34910 identifies it as a command injection flaw. Security teams should rely on the primary classification.
UniFi OS is closed-source firmware, so no source code or specific vulnerable code paths are publicly available for analysis.
Related Vulnerabilities in Bulletin 064
Security Advisory Bulletin 064 patches five distinct vulnerabilities. Three of them are rated critical. The table below lists those three, plus CVE-2026-34911:
| Vulnerability ID | CVSS Score | Attack Vector |
|---|---|---|
| CVE-2026-34908 | 10.0 Critical | Unauthenticated RCE |
| CVE-2026-34909 | 10.0 Critical | Path Traversal |
| CVE-2026-34910 | 10.0 Critical | Command Injection |
| CVE-2026-34911 | 7.7 High | Unknown |
With multiple critical vulnerabilities in one advisory, an unpatched device is exposed to several independent attack paths at once.
Patch Information
Ubiquiti fixed CVE-2026-34910 in firmware updates released on May 21, 2026, as part of Security Advisory Bulletin 064. Because UniFi OS is closed-source firmware, no source code diffs or commit-level changes are publicly available. The fix ships only through official firmware packages.
The vulnerability affects a broad range of UniFi OS hardware. Ubiquiti coordinated fixes across several firmware tracks at the same time, each one targeting a different hardware family:
| Product Family | Vulnerable Versions | Fixed Version |
|---|---|---|
| UCG Industrial | Up to and including 5.0.13 | 5.1.12 |
| UDM, UDM Pro, UDM SE, UDM Pro Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR Pro, UNVR Instant, ENVR, UCG Ultra, UCG Max, UCG Fiber | Up to and including 5.0.16 | 5.1.12 |
| UDR 5G, ENVR Core, UCKP, UCK, UCK Enterprise | Up to and including 5.0.17 | 5.1.12 |
| UNVR G2, UNVR G2 Pro | Up to and including 5.1.11 | 5.1.12 |
| UNAS 2, UNAS 4, UNAS Pro, UNAS Pro 4, UNAS Pro 8 | Up to and including 5.1.8 | 5.1.10 |
| UDM Beast | Up to and including 5.1.8 | 5.1.11 |
| UniFi OS Server (software only) | Up to and including 5.0.6 | 5.0.8 |
Most hardware devices converge on firmware version 5.1.12 as the patched release. The NAS product line needs 5.1.10, the UDM Beast needs 5.1.11, and the software-only UniFi OS Server needs 5.0.8.
The Cloud Gateways 5.1.12 release notes list this fix in their Bugfixes section and reference Security Advisory Bulletin 064. The UniFi OS Server 5.0.8 release notes say only "Improved stability," but the advisory itself names 5.0.8 as the remediation target.
CVE-2026-34910 was patched alongside four other vulnerabilities (CVE-2026-33000, CVE-2026-34908, CVE-2026-34909, and CVE-2026-34911), and the same firmware updates resolve all five issues in one deployment. Ubiquiti is distributing the update as a gradual rollout, so it may not appear for every user in the management console right away.
Interim Mitigations
Until the patch is deployed, organizations should use strict network segmentation to limit access to UniFi OS management interfaces. These interfaces should be reachable only from dedicated, monitored administrative VLANs and must be blocked from untrusted networks and the public internet.
Post-Patch Validation
Applying the patch alone does not remove unauthorized access from a device that was compromised through this command injection before patching. After updating, organizations should run integrity checks on all UniFi OS devices to confirm that no backdoors or persistence mechanisms were installed before remediation.
Affected Systems and Versions
The following UniFi OS product families and firmware versions are confirmed vulnerable:
UCG Industrial: All versions up to and including 5.0.13.
UDM, UDM Pro, UDM SE, UDM Pro Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR Pro, UNVR Instant, ENVR, UCG Ultra, UCG Max, UCG Fiber: All versions up to and including 5.0.16.
UDR 5G, ENVR Core, UCKP, UCK, UCK Enterprise: All versions up to and including 5.0.17.
UNVR G2, UNVR G2 Pro: All versions up to and including 5.1.11.
UNAS 2, UNAS 4, UNAS Pro, UNAS Pro 4, UNAS Pro 8: All versions up to and including 5.1.8.
UDM Beast: All versions up to and including 5.1.8.
UniFi OS Server (software only): All versions up to and including 5.0.6.
Any UniFi OS device reachable over the network and running a firmware version below the fixed release is vulnerable to unauthenticated command injection.
Vendor Security History
Ubiquiti has consolidated the fixes for five vulnerabilities into one advisory, Security Advisory Bulletin 064. Three of them carry CVSS 10.0 scores (CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910), a heavy concentration of critical-severity flaws for one release cycle. The vendor credited security researcher John Carroll with discovering CVE-2026-34910 and Hakai Security with finding CVE-2026-34911.
Community discussions reference earlier Ubiquiti security advisories, including Bulletin 062, which points to a pattern of periodic security updates for the UniFi platform. Past reporting has also covered critical UniFi vulnerabilities that could allow account hijacking, which suggests the UniFi OS attack surface has drawn repeated attention from researchers.
References
- Security Advisory Bulletin 064 (Ubiquiti Community)
- CVE-2026-34910 (CVE.org)
- UniFi OS Cloud Gateways 5.1.12 Release Notes
- UniFi OS Server 5.0.8 Release Notes
- Security Advisory Bulletin 064 Discussion (Ubiquiti Community)
- PSA: Update UniFi OS Now (Reddit)
- Update Your UniFi Gear ASAP (Reddit r/Ubiquiti)
