Ubiquiti patches three max-severity UniFi OS flaws (CVE-2026-34908/34909/34910) plus two more - ~100K endpoints exposed online

Ubiquiti has shipped patches for five UniFi OS vulnerabilities, three of which are CVSS-maximum and exploitable by remote unauthenticated attackers. CVE-2026-34908 is an improper access control that lets attackers make unauthorized changes; CVE-2026-34909 is a path traversal that reaches an underlying system account; CVE-2026-34910 is an unauthenticated command injection. Two additional flaws (CVE-2026-33000, a critical command injection, and CVE-2026-34911, a high-severity info disclosure) were also patched. All five came through Ubiquiti's HackerOne program. Censys is tracking close to 100,000 internet-exposed UniFi OS endpoints, around 50,000 of them in the US. Ubiquiti products were previously hijacked into the GRU-operated Moobot botnet.

Check

Inventory UniFi OS devices (Dream Machine, Cloud Key, UNVR, UCG) and their firmware version. Censys-check your egress IPs for exposed UniFi web interfaces and management ports.

Affected

All UniFi OS Consoles (Dream Machine, Cloud Key, UNVR, UCG) before the May 22 patches. Roughly 100,000 internet-exposed endpoints worldwide, with about 50,000 in the United States.

Fix

Apply Ubiquiti's UniFi OS updates immediately via the Network app or controller. Move management interfaces off the public internet. Restrict admin access to a management VLAN behind VPN.