CVE-2026-34908
CRITICAL KEVUbiquiti INC UniFi OS Server - Improper Access Control
Title source: ruleExploitation Summary
CVE-2026-34908 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 23, 2026. EIP tracks 1 public exploit from researchers including BishopFox.
AI-analyzed exploit summary This repository contains a safe detection script for CVE-2026-34908, an unauthenticated RCE chain in UniFi OS Server ≤ 5.0.6. The script probes for the vulnerability without executing any commands, using behavioral checks to determine if the auth bypass reaches the vulnerable handler.
Description
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
Exploits (1)
This repository contains a safe detection script for CVE-2026-34908, an unauthenticated RCE chain in UniFi OS Server ≤ 5.0.6. The script probes for the vulnerability without executing any commands, using behavioral checks to determine if the auth bypass reaches the vulnerable handler.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H