CVE-2026-34909

A malicious actor with access to the network could exploit a Path Traversal vulnerability found...

10.0 CriticalIn KEV

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

69.2%Up 69.2 points since May 22, 2026

What each source reports

CVE List Score used 10.0

Record: CVE-2026-34909
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2026-31384 10.0

Record: EUVD-2026-31384
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-95fp-244g-g3vr 10.0

A malicious actor with access to the network could exploit a Path Traversal vulnerability found...

Record: GHSA-95fp-244g-g3vr
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

CISA KEV No score

Ubiquiti UniFi OS Path Traversal Vulnerability

Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.

Record: CVE-2026-34909
Weakness: CWE-22
Updated: 2026-11-02

NVD 10.0

Record: CVE-2026-34909
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

Affected products

Show 56 moreShow less

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34909 is a critical vulnerability (CVSS 10.0) in Ubiquiti Unifi Os, published May 22, 2026. CISA lists it as known to be exploited, since June 23, 2026. EUVD reports exploitation since June 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 69.2%, the 99th percentile. No source names a fixed version.