PT-2026-42659 · Ubiquiti · Unifi Os

CVE-2026-34910

·

Published

2026-05-21

·

Updated

2026-07-14

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions UniFi OS (affected versions not specified)
Description An improper input validation issue exists in UniFi OS devices. A remote actor with network access can exploit this flaw to perform a command injection, which allows the execution of arbitrary commands on the system. Command injection is a technique where an attacker inserts malicious operating system commands into an application, which are then executed by the server.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Improper Access Control

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-20CWE-22CWE-284

Related Identifiers

BDU:2026-07798
BDU:2026-07799
BDU:2026-07800
CVE-2026-34910

Affected Products

Unifi Os