CVE-2026-34909: Ubiquiti UniFi OS — Path Traversal

Background

Ubiquiti’s UniFi OS platform powers the Dream Machine, Dream Router, Dream Wall, and Cloud Gateway product lines — network gateways that combine routing, firewall, VPN termination, and UniFi controller functionality in a single device. These appliances are widely deployed in small businesses and managed service provider environments and are commonly accessible via the internet for remote management.

CVE-2026-34909 is a path traversal vulnerability (CWE-22) affecting UniFi OS Server with a CVSS score of 10.0 CRITICAL. It allows an attacker with network access to traverse outside the intended directory boundary and read or manipulate files on the underlying Linux system. Sensitive targets include configuration files containing credentials, network topology data, and authentication material.

Bishop Fox researchers discovered CVE-2026-34909 as the second link in a three-CVE exploit chain alongside CVE-2026-34908 (access control bypass) and CVE-2026-34910 (command injection). Together, the chain enables an unauthenticated attacker with network access to achieve root code execution on UniFi OS devices.

Ubiquiti released UniFi OS Server 5.0.8 on 21 May 2026 to address all three vulnerabilities. CISA added CVE-2026-34909 to its Known Exploited Vulnerabilities catalog on 23 June 2026, with a federal remediation deadline of 26 June 2026.

Technical Mechanism

CVE-2026-34909 is rooted in how UniFi OS handles certain URL paths in its HTTP API. The vulnerability mechanism involves requests that begin with an auth-exempt URL prefix — a path the application treats as publicly accessible without authentication — but which, after URL normalisation, resolve to an authenticated internal route or file path.

By crafting a request that uses a legitimate auth-exempt prefix followed by path traversal sequences (../), an attacker can:

• Reach authenticated endpoints that should require valid credentials
• Access files outside the permitted serving directory, including system configuration files

Example traversal pattern:

GET /public/../../../../etc/unifi/system.properties HTTP/1.1

After normalisation, the path resolves to a privileged system file. Because the request began with the auth-exempt /public/ prefix, authentication is not enforced.

In the context of the full exploit chain:

1. CVE-2026-34908 establishes the initial auth bypass by exploiting the same auth-exempt prefix behaviour at the access control layer — an attacker reaches protected API functionality without a valid session.
2. CVE-2026-34909 extends this: with directory traversal, the attacker reads sensitive files from the device filesystem — credentials, SSH keys, device tokens — that can be used to authenticate to the system or escalate further.
3. CVE-2026-34910 completes the chain — using an established or reconstructed session, the attacker triggers command injection in the package update function to execute arbitrary OS commands as root.

Bishop Fox published a proof-of-concept demonstrating all three steps as a single automated exploit requiring no initial authentication.

Real-World Exploitation Evidence

Active exploitation of the CVE-2026-34908/34909/34910 chain was confirmed before patches were available. The primary observed post-exploitation indicator was the creation of rogue administrator accounts under the username ‘John Sim’ on compromised UniFi OS devices. The consistent username pattern across multiple reported incidents is consistent with an automated exploitation script in circulation.

CISA’s classification of CVE-2026-34909 as a Known Exploited Vulnerability confirms that exploitation has been observed in practice, not just theoretically demonstrated. The KEV deadline of 26 June 2026 reflects the urgency of the active exploitation picture.

Impact Assessment

• Credential exposure — path traversal targeting UniFi OS configuration files can expose admin credentials, Wi-Fi PSKs, VPN pre-shared keys, and RADIUS secrets stored on the device
• Authentication material access — SSH keys, API tokens, and session material stored on the filesystem can be retrieved and used to further authenticate to the device or connected systems
• File manipulation — write access via traversal enables an attacker to modify configuration files, inject malicious cron entries, or alter authentication settings before the command injection stage
• Chain prerequisite — CVE-2026-34909 is a critical link in the unauthenticated root RCE chain; without it, CVE-2026-34910 requires a pre-existing authenticated session
• Network-wide impact — the UniFi controller on the compromised device manages access points, switches, and cameras across the network; credentials extracted via traversal can cascade to all managed devices

Affected Versions

Remediation Steps

1. Update UniFi OS Server to version 5.0.8 or later:
   • Log into the UniFi OS console
   • Navigate to System > Updates
   • Apply the available UniFi OS firmware update
2. While patching is pending, restrict external access to the management interface:
   • Remove any WAN firewall rules that permit inbound access to the UniFi OS management ports (TCP 443, TCP 8443)
   • Limit management access to trusted internal IPs only
3. Audit for indicators of compromise:
   • Check UniFi OS > Admins and Users for unrecognised administrator accounts
   • Review access logs for unexpected requests to sensitive file paths
4. Rotate all credentials that may have been accessible via the file system:

   # Review which credentials are stored
   find /etc/unifi -name "*.properties" -o -name "*.json" | xargs grep -l "password\|secret\|key"

   Change admin passwords, Wi-Fi passwords, VPN pre-shared keys, and any API tokens in use
5. Check for SSH key additions to the device:

   cat /root/.ssh/authorized_keys
   cat /home/*/.ssh/authorized_keys

Detection Guidance

Web server access logs — look for requests containing path traversal sequences (../, %2e%2e/, ..%2f) in the URL path, particularly against management API endpoints.

File access anomalies — on patched or monitored systems, audit log entries for unexpected reads of /etc/unifi/, /data/, or /root/ by web server processes.

Suricata signature:

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"Ubiquiti UniFi OS CVE-2026-34909 Path Traversal Attempt"; flow:established,to_server; http.uri; pcre:"/(\.\.|%2e%2e|%252e%252e)/i"; http.uri; content:"/public/"; classtype:web-application-attack; sid:2034909; rev:1;)

IOCs:

• Requests containing ../ or URL-encoded equivalents (%2e%2e%2f) targeting UniFi OS management endpoints
• Unexpected reads of system configuration files by the UniFi web process
• Rogue admin account creation (username ‘John Sim’ in confirmed compromises)
• Unexpected SSH keys added to device

Timeline

References

• NVD — CVE-2026-34909
• CISA KEV Catalog
• Ubiquiti Security Advisory Bulletin 064
• SecurityWeek — Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs
• BleepingComputer — CISA warns of max severity Ubiquiti flaws exploited in attacks
• Security Affairs — CISA adds Ubiquiti UniFi OS flaws to KEV catalog
• integSec — CVE-2026-34909 UniFi OS Path Traversal Vulnerability