CVE-2026-34908
CRITICAL EXPLOITEDUbiquiti INC UniFi OS Server - Improper Access Control
Title source: ruleExploitation Summary
CVE-2026-34908 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including BishopFox.
AI-analyzed exploit summary This repository contains a safe detection script for CVE-2026-34908, an unauthenticated RCE chain in UniFi OS Server ≤ 5.0.6. The script probes for the vulnerability without executing any commands, using behavioral checks to determine if the auth bypass reaches the vulnerable handler.
Description
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
Exploits (1)
This repository contains a safe detection script for CVE-2026-34908, an unauthenticated RCE chain in UniFi OS Server ≤ 5.0.6. The script probes for the vulnerability without executing any commands, using behavioral checks to determine if the auth bypass reaches the vulnerable handler.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H