CVE-2026-34908_CVE-2026-34908

10 / 10

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

AI Analysis

Improper Access Control vulnerability allowing unauthorized system changes

Basic Information

ID CVE-2026-34908

Source hackerone

Published May 22, 2026 at 00:43

Affected Product

Vendor Ubiquiti Inc

Product UniFi OS Server

Affected Versions Ubiquiti Inc UniFi OS Server 0
Ubiquiti Inc UDM 0
Ubiquiti Inc UDM-Pro 0
Ubiquiti Inc UDM-SE 0
Ubiquiti Inc UDM-Pro-Max 0
Ubiquiti Inc UDM-Beast 0
Ubiquiti Inc EFG 0
Ubiquiti Inc UDW 0
Ubiquiti Inc UDR 0
Ubiquiti Inc UDR7 0
Ubiquiti Inc UDR-5G 0
Ubiquiti Inc Express 7 0
Ubiquiti Inc UNVR 0
Ubiquiti Inc UNVR-Pro 0
Ubiquiti Inc UNVR-Instant 0
Ubiquiti Inc UNVR-G2 0
Ubiquiti Inc UNVR-G2-Pro 0
Ubiquiti Inc ENVR 0
Ubiquiti Inc ENVR-Core 0
Ubiquiti Inc UNAS-2 0
Ubiquiti Inc UNAS-4 0
Ubiquiti Inc UNAS-Pro 0
Ubiquiti Inc UNAS-Pro-4 0
Ubiquiti Inc UNAS-Pro-8 0
Ubiquiti Inc UCKP 0
Ubiquiti Inc UCK 0
Ubiquiti Inc UCK-Enterprise 0
Ubiquiti Inc UCG-Ultra 0
Ubiquiti Inc UCG-Max 0
Ubiquiti Inc UCG-Fiber 0
Ubiquiti Inc UCG-Industrial 0

CWE Classification

CWE-284

AI Assessment

AI Score 10 / 10

AI Severity Critical

Vendor Ubiquiti Inc

Product UniFi OS

References

community.ui.com /releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b

{
    "lastseen": "",
    "description": "A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.",
    "published": "2026-05-22T00:43:49.077Z",
    "modified": "2026-05-22T00:43:49.077Z",
    "type": "cve",
    "title": "CVE-2026-34908",
    "source": "hackerone",
    "references": "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b",
    "id": "CVE-2026-34908",
    "bulletinFamily": "",
    "cwe": [
        "CWE-284"
    ],
    "cvelist": null,
    "sourceData": "Ubiquiti Inc UniFi OS Server 0\nUbiquiti Inc UDM 0\nUbiquiti Inc UDM-Pro 0\nUbiquiti Inc UDM-SE 0\nUbiquiti Inc UDM-Pro-Max 0\nUbiquiti Inc UDM-Beast 0\nUbiquiti Inc EFG 0\nUbiquiti Inc UDW 0\nUbiquiti Inc UDR 0\nUbiquiti Inc UDR7 0\nUbiquiti Inc UDR-5G 0\nUbiquiti Inc Express 7 0\nUbiquiti Inc UNVR 0\nUbiquiti Inc UNVR-Pro 0\nUbiquiti Inc UNVR-Instant 0\nUbiquiti Inc UNVR-G2 0\nUbiquiti Inc UNVR-G2-Pro 0\nUbiquiti Inc ENVR 0\nUbiquiti Inc ENVR-Core 0\nUbiquiti Inc UNAS-2 0\nUbiquiti Inc UNAS-4 0\nUbiquiti Inc UNAS-Pro 0\nUbiquiti Inc UNAS-Pro-4 0\nUbiquiti Inc UNAS-Pro-8 0\nUbiquiti Inc UCKP 0\nUbiquiti Inc UCK 0\nUbiquiti Inc UCK-Enterprise 0\nUbiquiti Inc UCG-Ultra 0\nUbiquiti Inc UCG-Max 0\nUbiquiti Inc UCG-Fiber 0\nUbiquiti Inc UCG-Industrial 0",
    "sourceHref": "",
    "cvss": {
        "score": 10,
        "severity": "CRITICAL",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "UniFi OS Server",
    "version": "0",
    "vendor": "Ubiquiti Inc",
    "ai_description": "Improper Access Control vulnerability allowing unauthorized system changes",
    "ai_severity": "Critical",
    "ai_vendor": "Ubiquiti Inc",
    "ai_product": "UniFi OS",
    "ai_version": "0",
    "ai_score": 10
}