Ubiquiti Patches Critical UniFi OS Privilege Escalation Flaws

Gbhackers •Eswar • May 23, 2026

Ubiquiti has released urgent security patches for five critical and high-severity vulnerabilities across its UniFi OS platform, addressing flaws that could allow remote attackers to execute arbitrary commands and escalate privileges on a wide range of UniFi devices. The flaws also span improper access control and path traversal, affecting a broad range of UniFi OS […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ubiquiti Patches Critical Vulnerabilities in UniFi OS Exposing Remote Attacks Ubiquiti has issued security updates for five critical vulnerabilities in UniFi OS, including three maximum severity flaws (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) that allow remote attackers to execute unauthorized commands and escalate privileges. The vulnerabilities can be exploited without user privileges and were reported through Ubiquiti's HackerOne bug bounty program. Censys reports nearly 100,000 internet-exposed UniFi OS endpoints, predominantly in the U.S. Ubiquiti has not confirmed if these vulnerabilities were exploited in the wild prior to the patch release. The company has a history of being targeted by state-backed groups and cybercriminals, with previous incidents involving botnets utilizing compromised devices. Additional vulnerabilities patched include a critical command injection flaw (CVE-2026-33000) and a high-severity information disclosure issue (CVE-2026-34911). 51 sources 78

Extracted Entities

CWE Weaknesses (3)

CWE-22 - Path Traversal CWE-269 - Improper Privilege Management CWE-78 - OS Command Injection

Platforms (1)

UniFi OS