Ubiquiti Patches Critical UniFi OS Vulnerabilities Allowing Remote Privilege Escalation

Cybersecuritynews •Guru Baran • May 22, 2026

Ubiquiti Networks has released urgent security updates to address a series of highly critical vulnerabilities affecting its UniFi OS platform. These severe flaws could allow unauthenticated, remote attackers to execute arbitrary code, escalate privileges, and severely compromise enterprise network infrastructure. In total, the hardware vendor patched five distinct security issues, three of which carry a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ubiquiti Patches Critical Vulnerabilities in UniFi OS Exposing Remote Attacks Ubiquiti has issued security updates for five critical vulnerabilities in UniFi OS, including three maximum severity flaws (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) that allow remote attackers to execute unauthorized commands and escalate privileges. The vulnerabilities can be exploited without user privileges and were reported through Ubiquiti's HackerOne bug bounty program. Censys reports nearly 100,000 internet-exposed UniFi OS endpoints, predominantly in the U.S. Ubiquiti has not confirmed if these vulnerabilities were exploited in the wild prior to the patch release. The company has a history of being targeted by state-backed groups and cybercriminals, with previous incidents involving botnets utilizing compromised devices. Additional vulnerabilities patched include a critical command injection flaw (CVE-2026-33000) and a high-severity information disclosure issue (CVE-2026-34911). 51 sources 78

Extracted Entities

Platforms (1)

UniFi OS