Path traversal in Ubiquiti UniFi OS Server
Priority CRITICAL 100Exploited in the wildCWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.
Why it matters now
Exploitation Active In CISA KEV since 2026-06-23CISA due date 2026-06-26
EPSS 0.69235 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed UniFi OS Server (Ubiquiti Inc): 5.0.8Express (Ubiquiti Inc): 4.0.14+30 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ubiquiti | UniFi OS Server | before 5.0.8 | 5.0.8 | Patch available | CNA |
| Ubiquiti | Express | before 4.0.14 | 4.0.14 | Patch available | CNA |
| Ubiquiti | UDM | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDM-Pro | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDM-SE | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDM-Pro-Max | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDM-Beast | before 5.1.11 | 5.1.11 | Patch available | CNA |
| Ubiquiti | EFG | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDW | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDR | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDR7 | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDR-5G | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | Express 7 | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR-Pro | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR-Instant | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR-G2 | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR-G2-Pro | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | ENVR | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | ENVR-Core | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNAS-2 | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UNAS-4 | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UNAS-Pro | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UNAS-Pro-4 | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UNAS-Pro-8 | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UCKP | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCK | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCK-Enterprise | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCG-Ultra | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCG-Max | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCG-Fiber | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCG-Industrial | before 5.1.12 | 5.1.12 | Patch available | CNA |
- UniFi OS Server VendorUbiquiti Affected before 5.0.8 Fixed in 5.0.8 Patch available CNA
- Express VendorUbiquiti Affected before 4.0.14 Fixed in 4.0.14 Patch available CNA
- UDM VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDM-Pro VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDM-SE VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDM-Pro-Max VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDM-Beast VendorUbiquiti Affected before 5.1.11 Fixed in 5.1.11 Patch available CNA
- EFG VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDW VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDR VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDR7 VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDR-5G VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- Express 7 VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR-Pro VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR-Instant VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR-G2 VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR-G2-Pro VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- ENVR VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- ENVR-Core VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNAS-2 VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UNAS-4 VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UNAS-Pro VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UNAS-Pro-4 VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UNAS-Pro-8 VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UCKP VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCK VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCK-Enterprise VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCG-Ultra VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCG-Max VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCG-Fiber VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCG-Industrial VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
CPE configurations NVD · 63
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:* | before 5.0.8 | Vulnerable | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
- cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:* Versions before 5.0.8 Vulnerable ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
Show 53 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:enterprise_fortress_gateway:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_express_7:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_ultra:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloudkey_enterprise:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:* | before 5.1.11 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_pro_4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_pro_8:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_express_firmware:*:*:*:*:*:*:*:* | before 4.0.14 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_express:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
- cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:enterprise_fortress_gateway:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_express_7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_ultra:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloudkey_enterprise:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:* Versions before 5.1.11 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_pro_4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_pro_8:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_express_firmware:*:*:*:*:*:*:*:* Versions before 4.0.14 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_express:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
Remediation
- Fix · CNA UniFi OS Server (Ubiquiti Inc) Fixed in 5.0.8
- Fix · CNA Express (Ubiquiti Inc) Fixed in 4.0.14
- Fix · CNA UDM (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDM-Pro (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDM-SE (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDM-Pro-Max (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDM-Beast (Ubiquiti Inc) Fixed in 5.1.11
- Fix · CNA EFG (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDW (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDR (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDR7 (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDR-5G (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA Express 7 (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR-Pro (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR-Instant (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR-G2 (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR-G2-Pro (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA ENVR (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA ENVR-Core (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNAS-2 (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UNAS-4 (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UNAS-Pro (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UNAS-Pro-4 (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UNAS-Pro-8 (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UCKP (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCK (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCK-Enterprise (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCG-Ultra (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCG-Max (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCG-Fiber (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCG-Industrial (Ubiquiti Inc) Fixed in 5.1.12
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Ubiquiti UniFi OS Server 5.0.8
5 records Highest priority Priority CRITICAL 3 CRITICAL, 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-27142 Improper input validation in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- TI-2026-27140 Improper access control in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- TI-2026-25448 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 44
- Release ·
Ubiquiti EFG, ENVR and 28 more products 5.1.10, 5.1.11, 5.1.12
4 records Highest priority Priority CRITICAL 3 CRITICAL, 1 LOW
Other records, highest priority first
- TI-2026-27142 Improper input validation in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- TI-2026-27140 Improper access control in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- TI-2026-27143 Path traversal in Ubiquiti UniFi OS ServerPriority LOW 35
Timeline
- 2026-06-23 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2026-34909
- 2026-10-03 Alias added: GHSA-95fp-244g-g3vr
- 2026-10-25 EPSS moved to the 99th percentile and above
References
More Ubiquiti Enterprise Fortress Gateway Firmware vulnerabilities
- TI-2026-27142 Improper input validation in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-27140 Improper access control in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-39278 Improper input validation in Ubiquiti UniFi OS Server CVSS 3.1CRITICAL 9.9
- TI-2026-39279 Path traversal in Ubiquiti UniFi OS Server CVSS 3.1HIGH 8.6
- TI-2026-39280 SQL injection in Ubiquiti UniFi OS Server CVSS 3.1HIGH 8.8
- TI-2026-39277 Server-side request forgery in Ubiquiti UniFi OS Server CVSS 3.1HIGH 8.8
Sources
- CVE-2026-34909 · CVE Program
- CVE-2026-34909 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-95fp-244g-g3vr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences