CVE-2026-34908: Ubiquiti UniFi OS Improper Access Control Vulnerability
Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.
Overview
An improper access control flaw in Ubiquiti UniFi OS allows an unauthenticated attacker with network access to bypass authentication entirely and make unauthorized changes to affected devices. The flaw spans a wide range of UniFi hardware, including Dream Machine, UniFi Network Video Recorder, CloudKey, and gateway appliances, all running firmware below the patched thresholds. No credentials or user interaction are required, and the vulnerability has been observed exploited in the wild.
Vulnerability details
UniFi OS fails to enforce access controls on inbound HTTP requests at a trust boundary between the external network and internal services. The weakness (CWE-284) manifests when the system accepts attacker-supplied input, either spoofed internal identity headers or encoded path-traversal sequences, and acts on them as if they were legitimate internal signals. Because the proxy layer does not verify that these headers originate from a trusted internal source, an external request carrying headers such as X-UserId or X-UserRole is treated as an authorized internal call, granting access to restricted functionality without any credential check.
An attacker with network reach to an affected device sends a crafted HTTP request containing either spoofed internal identity headers (X-UserId, X-UserRole, X-UserAccessMask, X-UserPermissionMask, X-ApiKeyId, X-Token, X-From-Service, X-UI-Peer-Token) or encoded path-traversal sequences (..%2f) in the URL path. No authentication is required. This grants access to restricted system functionality and the ability to make unauthorized changes. Third-party analysis of in-the-wild traffic observed this access control bypass chained with a separate command injection vulnerability to drop a Mirai-class botnet implant on compromised devices.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor HTTP access logs on UniFi OS devices for inbound requests containing internal proxy headers (X-UserId, X-UserRole, X-UserAccessMask, X-UserPermissionMask, X-ApiKeyId, X-Token, X-From-Service, X-UI-Peer-Token) originating from external, non-loopback source addresses — these headers should never appear in externally sourced requests.
- Inspect web server or reverse-proxy logs for URL paths containing percent-encoded traversal sequences (%2f, %2e%2e, ..%2f) in requests that have no associated authenticated session, particularly on proxy or API routes.
Remediation
Additional hardening
- Update UniFi OS Server to version 5.0.8 or later, and update UDM-Beast to 5.1.11 or later; for all other affected hardware (UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR variants, UNVR variants, ENVR variants, UCG variants, UCK variants, UNAS variants, Express 7, UCKP), consult the vendor advisory listed in References for the applicable fixed version boundary per device.
- Restrict management-plane access to UniFi OS devices using firewall rules or ACLs so that only trusted administrative hosts or networks can reach the device's HTTP interface, reducing exposure to unauthenticated network attackers.
- Audit network segmentation to confirm that UniFi OS management interfaces are not directly reachable from untrusted networks, guest VLANs, or the public internet; place devices behind a dedicated management VLAN with strict ingress filtering.
- Review device logs and system state for unexpected configuration changes, new user accounts, or unfamiliar scheduled tasks that may indicate unauthorized access prior to patching.
Key dates
References
- https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-34908
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908
- https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/
Frequently asked questions
Does CVE-2026-34908 affect my FedRAMP authorization?
If Ubiquiti UniFi OS runs inside your authorization boundary, yes. CVE-2026-34908 appears on CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of June 26, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in your boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your options are to remediate it immediately or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-34908?
Knox does not patch your software. Remediating Ubiquiti UniFi OS is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The remediation work is yours to carry out; maintaining a defensible compliance posture while you do it is not something you have to manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When something like CVE-2026-34908 surfaces, exposure appears during ongoing monitoring rather than waiting until an assessor flags it at a scheduled review. That gap between disclosure and discovery is where risk accumulates, and continuous monitoring closes it.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-34908's remediation deadline of June 26, 2026 has passed. What happens now?
If CVE-2026-34908 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out now and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid footing.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
