CVE-2026-34909: Ubiquiti UniFi OS path traversal, actively exploited
The short version: UniFi OS devices have a path-traversal flaw (CVE-2026-34909) that lets an unauthenticated attacker slip past the auth boundary to internal handlers and read files that can be leveraged into account access. It scores a maximum 10.0, it's in CISA's KEV catalog, and it's being exploited. Update UniFi OS now. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | ~2.3% · 81st percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-06-26 |
| Known exploited? | Yes — KEV-listed; exploitation of the UniFi OS advisory's flaws reported in the wild |
| Vulnerability type | CWE-22 path traversal → auth-boundary bypass → file read → potential account access |
| Requires authenticated session? | No — pre-authentication |
| Affected | UniFi OS devices (versions prior to the patched release — see vendor advisory) |
| Fixed in | The fixed UniFi OS release per Ubiquiti's Security Advisory Bulletin 064 |
What you need to know
CVE-2026-34909 is a path traversal in UniFi OS — the operating system on Ubiquiti's UniFi gateway and console devices. An unauthenticated attacker sends a crafted request whose traversal sequence walks past the authentication endpoint into an internal proxy handler, reaching functionality that should be gated. From there the attacker can read files that lead to underlying account access.
Why this one is top-of-queue:
- It's the gateway device itself — often internet-facing so it can manage remote sites, and a compromise reaches the network boundary it's supposed to enforce.
- It's pre-authentication — the traversal steps around the auth check entirely.
- It's being exploited. It's in KEV, and reporting around Ubiquiti's June 2026 bulletin describes in-the-wild attacks against these devices, including botnet activity.
How serious we see it
High — the 10.0 is earned here.
Unauthenticated, network-reachable file access that bypasses authentication on an internet-facing gateway, listed in KEV with a hard remediation date, is exactly what belongs at the top of the queue — even though EPSS hasn't caught up to the KEV signal. We rate it by exposure and confirmed use, not by a probability score that lags. The bounded, reassuring part is that it's fixed: Ubiquiti published patched UniFi OS builds, and exposure is quick to confirm.
Recommendations
Straight from Ubiquiti's advisory and CISA:
- Update UniFi OS now to the fixed release per Security Advisory Bulletin 064.
- Restrict management exposure. Keep the device's admin/remote-access surface off the open internet where possible; limit it to trusted networks or a VPN.
- Hunt for prior use. Review for unexpected access and signs of compromise given confirmed in-the-wild activity.
- If compromised, respond. Rebuild where warranted and rotate credentials the device could reach.
- Confirm your exposure first. Verify which UniFi OS devices you run and their versions.
How BreachRisk sees it
BreachRisk discovers internet-facing UniFi OS devices from the outside, fingerprints them, and flags exposure tied to this KEV-listed, actively exploited CVE so it rises to the top of your results. Where safe verification is possible, it issues a single bounded, non-destructive request to confirm the traversal reaches the internal handler — proof, not a maybe, and never a weaponized exploit. When a gateway flaw is being exploited in the wild, the exposed device is already mapped, so you go straight to patch-and-verify.