# CVE-2026-34908

## Summary

- **CVE ID:** CVE-2026-34908
- **Severity:** CRITICAL
- **CVSS Score:** 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- **CWE:** CWE-284
- **Published:** May 22, 2026
- **Last Modified:** Jun 24, 2026

## Description

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

## Affected Products

- Ubiquiti Inc — UniFi OS Server (0)
- Ubiquiti Inc — UDM (0)
- Ubiquiti Inc — UDM-Pro (0)
- Ubiquiti Inc — UDM-SE (0)
- Ubiquiti Inc — UDM-Pro-Max (0)
- Ubiquiti Inc — UDM-Beast (0)
- Ubiquiti Inc — EFG (0)
- Ubiquiti Inc — UDW (0)
- Ubiquiti Inc — UDR (0)
- Ubiquiti Inc — UDR7 (0)
- Ubiquiti Inc — UDR-5G (0)
- Ubiquiti Inc — Express 7 (0)
- Ubiquiti Inc — UNVR (0)
- Ubiquiti Inc — UNVR-Pro (0)
- Ubiquiti Inc — UNVR-Instant (0)
- Ubiquiti Inc — UNVR-G2 (0)
- Ubiquiti Inc — UNVR-G2-Pro (0)
- Ubiquiti Inc — ENVR (0)
- Ubiquiti Inc — ENVR-Core (0)
- Ubiquiti Inc — UNAS-2 (0)
- Ubiquiti Inc — UNAS-4 (0)
- Ubiquiti Inc — UNAS-Pro (0)
- Ubiquiti Inc — UNAS-Pro-4 (0)
- Ubiquiti Inc — UNAS-Pro-8 (0)
- Ubiquiti Inc — UCKP (0)
- Ubiquiti Inc — UCK (0)
- Ubiquiti Inc — UCK-Enterprise (0)
- Ubiquiti Inc — UCG-Ultra (0)
- Ubiquiti Inc — UCG-Max (0)
- Ubiquiti Inc — UCG-Fiber (0)
- Ubiquiti Inc — UCG-Industrial (0)

## References

- [CNA](https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b)
- [CISA-ADP](https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/)
- [CISA-ADP](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 85.19%
- **EPSS Percentile:** 99.7

## Known Exploited Vulnerabilities (KEV)

- **Date Added:** Jun 23, 2026
- **Due Date:** Jun 26, 2026

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._