# CVE-2026-34908: UniFi OS Server - Improper Access Control

> Live exploitation tracking for CVE-2026-34908 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-34908

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Ubiquiti Inc UniFi OS Server, Ubiquiti Inc UDM, Ubiquiti Inc UDM-Pro, Ubiquiti Inc UDM-SE, Ubiquiti Inc UDM-Pro-Max, Ubiquiti Inc UDM-Beast, Ubiquiti Inc EFG, Ubiquiti Inc UDW, Ubiquiti Inc UDR, Ubiquiti Inc UDR7, Ubiquiti Inc UDR-5G, Ubiquiti Inc Express 7, Ubiquiti Inc UNVR, Ubiquiti Inc UNVR-Pro, Ubiquiti Inc UNVR-Instant, Ubiquiti Inc UNVR-G2, Ubiquiti Inc UNVR-G2-Pro, Ubiquiti Inc ENVR, Ubiquiti Inc ENVR-Core, Ubiquiti Inc UNAS-2, Ubiquiti Inc UNAS-4, Ubiquiti Inc UNAS-Pro, Ubiquiti Inc UNAS-Pro-4, Ubiquiti Inc UNAS-Pro-8, Ubiquiti Inc UCKP, Ubiquiti Inc UCK, Ubiquiti Inc UCK-Enterprise, Ubiquiti Inc UCG-Ultra, Ubiquiti Inc UCG-Max, Ubiquiti Inc UCG-Fiber, Ubiquiti Inc UCG-Industrial
- **Weaknesses:** CWE-284 (Improper Access Control)
- **Tags:** iot

## Description

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

## CrowdSec analysis

[CVE-2026-34908](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-34908) is a critical improper access control vulnerability affecting Ubiquiti UniFi OS Server and numerous UniFi devices. A network-accessible attacker can exploit the flaw without authentication to make unauthorized system changes, potentially compromising confidentiality, integrity, and availability across affected environments.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-34908 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2026-34908 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2026-34908 is currently experiencing high visibility and active exploitation across the internet.

Attackers target UniFi OS devices with requests to `/api/auth/validate-sso/` containing encoded parent-directory traversal sequences such as `..%2f`, attempting to reach the protected `/proxy/users/api/v2/ucs/update/latest_package` endpoint without authentication. Detection should focus on traversal-encoded paths combined with access to this proxy endpoint, particularly when the server returns a successful response or UniFi-specific error markers such as `pkg_name required` and `CODE_SYSTEM_ERROR`.

## Timeline

- 2026-05-22: CVE Published. CVE-2026-34908 is published to NVD.
- 2026-06-23: CISA KEV. CVE-2026-34908 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-06-26: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-08-25: Rule Released. CrowdSec releases a rule to detect CVE-2026-34908 exploitation attempts against the CrowdSec Network.
- 2026-08-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-34908 for the first time.

## References

- https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908
- https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34908.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-34908) follows observed exploitation activity for CVE-2026-34908. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.