boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 5, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-34908

CVE-2026-34908CRITICAL
Ubiquiti UniFi OS
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .1521   96.7   YES
AFFECTED
  Product          Versions     Fixed
  UniFi OS Server  unspecified  —
  UDM              unspecified  —
  UDM-Pro          unspecified  —
  UDM-SE           unspecified  —
  UDM-Pro-Max      unspecified  —
  UDM-Beast        unspecified  —
  EFG              unspecified  —
  UDW              unspecified  —
  UDR              unspecified  —
  UDR7             unspecified  —
  + 21 more
TIMELINE
  Mar 31  Reserved by hackerone
  Jun 23  EXPLOIT PUBLISHED — CVE-2026-34908 (Ubiquiti Inc UniFi OS Server). Public exploit reference added.
  Jun 23  Added to CISA KEV, remediation due 2026-06-26
  Jun 23  Published (CNA: hackerone)
  Jun 27  DUE DATE PASSED — CVE-2026-34908 (Ubiquiti Inc UniFi OS Server). CISA remediation deadline was June 26, 2026; still in catalog.
  Jul 23  ENRICHED — CVE-2026-34908 (Ubiquiti UniFi OS). Received CVSS 10.0 and CPE data from NVD.
  Jul 23  EXPLOIT PUBLISHED — CVE-2026-34908 (Ubiquiti UniFi OS). Public exploit reference added.
CWE-284 · CNA: hackerone · CVSS v3.1 · 3 references · NVD status: Analyzed · KEV due June 26, 2026

Description

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

Lifecycle

Complete event history — 7 events, chronological
DateEventDetail
March 31, 2026ReservedReserved by hackerone
June 23, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-34908 (Ubiquiti Inc UniFi OS Server). Public exploit reference added.
June 23, 2026KEV ADDEDAdded to CISA KEV, remediation due 2026-06-26
June 23, 2026PublishedPublished (CNA: hackerone)
June 27, 2026DUE DATE PASSEDDUE DATE PASSED — CVE-2026-34908 (Ubiquiti Inc UniFi OS Server). CISA remediation deadline was June 26, 2026; still in catalog.
July 23, 2026ENRICHEDENRICHED — CVE-2026-34908 (Ubiquiti UniFi OS). Received CVSS 10.0 and CPE data from NVD.
July 23, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-34908 (Ubiquiti UniFi OS). Public exploit reference added.

Affected

Affected products and packages — 31 rows
VendorProduct / PackageEcosystemVersion introducedFixed
Ubiquiti IncUniFi OS Server———
Ubiquiti IncUDM———
Ubiquiti IncUDM-Pro———
Ubiquiti IncUDM-SE———
Ubiquiti IncUDM-Pro-Max———
Ubiquiti IncUDM-Beast———
Ubiquiti IncEFG———
Ubiquiti IncUDW———
Ubiquiti IncUDR———
Ubiquiti IncUDR7———
Ubiquiti IncUDR-5G———
Ubiquiti IncExpress 7———
Ubiquiti IncUNVR———
Ubiquiti IncUNVR-Pro———
Ubiquiti IncUNVR-Instant———
Ubiquiti IncUNVR-G2———
Ubiquiti IncUNVR-G2-Pro———
Ubiquiti IncENVR———
Ubiquiti IncENVR-Core———
Ubiquiti IncUNAS-2———
Ubiquiti IncUNAS-4———
Ubiquiti IncUNAS-Pro———
Ubiquiti IncUNAS-Pro-4———
Ubiquiti IncUNAS-Pro-8———
Ubiquiti IncUCKP———
Ubiquiti IncUCK———
Ubiquiti IncUCK-Enterprise———
Ubiquiti IncUCG-Ultra———
Ubiquiti IncUCG-Max———
Ubiquiti IncUCG-Fiber———
Ubiquiti IncUCG-Industrial———

Weaknesses

CWE-284

References (3)

Related

Authoritative record: CVE-2026-34908 at cve.org

Vendors: ubiquiti

Weaknesses: CWE-284

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-34908 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 5, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.