CVE record · CVE-2026-34908

Improper access control in Ubiquiti Inc UniFi OS Server and others

CVSS 10.0 CriticalCriticalIn CISA KEVEPSS 0.89 · 99th percentile

Critical, because:

In CISA’s KEV catalogue since 23 Jun 2026: it is known to be exploited.
CVSS score 10.0: 9.0 or more.
CVSS score 10.0 (7.0 or more) and EPSS 0.89 (0.1 or more): a high score and a real chance of exploitation in the next 30 days.

Published by the CVE Program (CNA: hackerone) at 22 May 2026, 00:43 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Ubiquiti Inc	UniFi OS Server	affected before 5.0.8 semver Other versions: unaffected
Ubiquiti Inc	UDM	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UDM-Pro	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UDM-SE	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UDM-Pro-Max	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UDM-Beast	affected before 5.1.11 semver Other versions: unaffected
Ubiquiti Inc	EFG	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UDW	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UDR	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UDR7	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UDR-5G	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	Express 7	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UNVR	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UNVR-Pro	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UNVR-Instant	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UNVR-G2	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UNVR-G2-Pro	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	ENVR	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	ENVR-Core	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UNAS-2	affected before 5.1.10 semver Other versions: unaffected
Ubiquiti Inc	UNAS-4	affected before 5.1.10 semver Other versions: unaffected
Ubiquiti Inc	UNAS-Pro	affected before 5.1.10 semver Other versions: unaffected
Ubiquiti Inc	UNAS-Pro-4	affected before 5.1.10 semver Other versions: unaffected
Ubiquiti Inc	UNAS-Pro-8	affected before 5.1.10 semver Other versions: unaffected
Ubiquiti Inc	UCKP	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UCK	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UCK-Enterprise	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UCG-Ultra	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UCG-Max	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UCG-Fiber	affected before 5.1.12 semver Other versions: unaffected
Ubiquiti Inc	UCG-Industrial	affected before 5.1.12 semver Other versions: unaffected

Identifiers: CVE-2026-34908
CNA: hackerone
Weakness (CWE): CWE-284
Tags: Ubiquiti Inc UniFi OS Server
Ubiquiti Inc UDM
Ubiquiti Inc UDM-Pro
Ubiquiti Inc UDM-SE
Ubiquiti Inc UDM-Pro-Max
Ubiquiti Inc UDM-Beast
Ubiquiti Inc EFG
Ubiquiti Inc UDW
Broken access control
Published: 22 May 2026
Updated: 24 Jun 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
10.0	Critical	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	CNA (hackerone)

CISA KEV Listed since 23 Jun 2026: known to be exploited.
EPSS 0.89, the 99th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 22 May 2026. New records show when each source confirmed them.

Sources

References from the CNA

community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.