CVE-2026-34910: Ubiquiti UniFi OS Improper Input Validation Vulnerability
Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.
Overview
Ubiquiti UniFi OS contains an improper input validation flaw in its software update endpoint that allows an unauthenticated remote attacker to inject arbitrary OS commands. Successful exploitation gives the attacker full control of the device. The flaw affects a wide range of UniFi OS hardware including Dream Machine variants, UniFi Network Video Recorders, Cloud Gateways, CloudKeys, and NAS appliances running firmware below product-specific thresholds. Active exploitation has been observed in the wild, with attackers using the vulnerability to drop Mirai-class botnet implants.
Vulnerability details
The update endpoint in UniFi OS accepts a user-supplied parameter, pkg_name, that is passed without sanitization to a shell execution context (/bin/sh -c). When the parameter by_cmd=true accompanies a pkg_name value containing shell metacharacters such as $(), semicolons, pipes, or backticks, the OS executes the injected command. The endpoint is normally protected by authentication, but a path traversal in the URL (using encoded sequences such as ..%2f) allows an attacker to reach it without credentials, bypassing the access control boundary entirely.
An attacker with network access to an affected device sends a crafted HTTP request to the traversal-bypassed update path, supplying a pkg_name value containing shell metacharacters. No authentication or user interaction is required. Third-party analysis of in-the-wild traffic shows attackers chaining the traversal bypass with the command injection to achieve code execution, then dropping a Mirai-class loader ('zok') to recruit the device into a botnet. The attacker gains full system-level control of the device.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor HTTP access logs for requests containing encoded path traversal sequences (..%2f, %2e%2e) targeting paths that include /api/auth/validate-sso/ combined with /proxy/ or /ucs/update/; this pattern is not present in normal management traffic.
- Alert on unexpected outbound connections from UniFi OS devices to external hosts shortly after an inbound request to the update API path, particularly connections initiating binary downloads or establishing persistent sessions with no corresponding scheduled update event.
- Audit system process logs for /bin/sh or shell child processes spawned by the UniFi update service outside of a legitimate firmware update window; legitimate updates follow scheduled or administrator-initiated flows and do not produce ad-hoc shell invocations.
Remediation
Additional hardening
- Update UniFi OS Server to version 5.0.8 or later, and UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, and most other affected appliances to version 5.1.12 or later; see the vendor advisory in References for the full per-model version table.
- Restrict management interface access to trusted administrative networks using firewall rules or ACLs; devices with the management port exposed to the internet present the highest risk given the unauthenticated network attack path.
- Where immediate patching is not possible, place affected devices behind a network boundary that blocks untrusted inbound HTTP/HTTPS to the management interface, reducing the attacker's ability to reach the vulnerable endpoint.
- Conduct forensic triage on any device that was internet-exposed while running a vulnerable firmware version, checking for unexpected processes, scheduled tasks, or outbound connections consistent with botnet implant activity.
Key dates
References
- https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-34910
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34910
- https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/
Frequently asked questions
Does CVE-2026-34910 affect my FedRAMP authorization?
If Ubiquiti UniFi OS runs inside your authorization boundary, CVE-2026-34910 is your problem. This Critical-severity vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its June 26, 2026 remediation deadline has already passed. An unpatched KEV inside a FedRAMP boundary is an assessor finding. An overdue one is visible to your assessor and sponsoring agency right now. Your options are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-34910?
Knox does not patch Ubiquiti UniFi OS on your behalf. Under the FedRAMP shared-responsibility model, remediating CVE-2026-34910 is your obligation. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage to document the fix for your next assessment. The remediation work is yours to execute; maintaining a defensible compliance posture while you do it is not something you have to manage alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When something like CVE-2026-34910 surfaces, exposure is identified through ongoing monitoring rather than surfacing only when an assessor reviews your boundary at assessment time.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-34910's remediation deadline of June 26, 2026 has passed. What happens now?
If CVE-2026-34910 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid ground.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
