Improper Access Control in UniFi OS Enables Unauthorized System Changes
CVE-2026-34908 Published on May 22, 2026

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

NVD

Known Exploited Vulnerability

This Ubiquiti UniFi OS Improper Access Control Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.

The following remediation steps are recommended / required by June 26, 2026: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicab

Weakness Type

What is an Authorization Vulnerability?

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVE-2026-34908 has been classified to as an Authorization vulnerability or weakness.

Affected Versions

Ubiquiti Inc UniFi OS Server:

Before 5.0.8 is affected.

Ubiquiti Inc UDM:

Before 5.1.12 is affected.

Ubiquiti Inc UDM-Pro:

Before 5.1.12 is affected.

Ubiquiti Inc UDM-SE:

Before 5.1.12 is affected.

Ubiquiti Inc UDM-Pro-Max:

Before 5.1.12 is affected.

Ubiquiti Inc UDM-Beast:

Before 5.1.11 is affected.

Ubiquiti Inc EFG:

Before 5.1.12 is affected.

Ubiquiti Inc UDW:

Before 5.1.12 is affected.

Ubiquiti Inc UDR:

Before 5.1.12 is affected.

Ubiquiti Inc UDR7:

Before 5.1.12 is affected.

Ubiquiti Inc UDR-5G:

Before 5.1.12 is affected.

Ubiquiti Inc Express 7:

Before 5.1.12 is affected.

Ubiquiti Inc UNVR:

Before 5.1.12 is affected.

Ubiquiti Inc UNVR-Pro:

Before 5.1.12 is affected.

Ubiquiti Inc UNVR-Instant:

Before 5.1.12 is affected.

Ubiquiti Inc UNVR-G2:

Before 5.1.12 is affected.

Ubiquiti Inc UNVR-G2-Pro:

Before 5.1.12 is affected.

Ubiquiti Inc ENVR:

Before 5.1.12 is affected.

Ubiquiti Inc ENVR-Core:

Before 5.1.12 is affected.

Ubiquiti Inc UNAS-2:

Before 5.1.10 is affected.

Ubiquiti Inc UNAS-4:

Before 5.1.10 is affected.

Ubiquiti Inc UNAS-Pro:

Before 5.1.10 is affected.

Ubiquiti Inc UNAS-Pro-4:

Before 5.1.10 is affected.

Ubiquiti Inc UNAS-Pro-8:

Before 5.1.10 is affected.

Ubiquiti Inc UCKP:

Before 5.1.12 is affected.

Ubiquiti Inc UCK:

Before 5.1.12 is affected.

Ubiquiti Inc UCK-Enterprise:

Before 5.1.12 is affected.

Ubiquiti Inc UCG-Ultra:

Before 5.1.12 is affected.

Ubiquiti Inc UCG-Max:

Before 5.1.12 is affected.

Ubiquiti Inc UCG-Fiber:

Before 5.1.12 is affected.

Ubiquiti Inc UCG-Industrial:

Before 5.1.12 is affected.

Exploit Probability

EPSS

0.57%

Percentile

42.42%