CVE-2026-34909: Ubiquiti Uni Fi OS Path Traversal Vulnerability
Summary: CISA's Known Exploited Vulnerabilities catalog lists CVE-2026-34909, a path traversal flaw in Ubiquiti UniFi OS that could let an actor with network access reach files on the underlying system and manipulate them to access an underlying account. The catalog sets a remediation due date of 2026-06-26 and records known ransomware campaign use as unknown.
Why it matters: The entry confirms this flaw is being exploited in the wild, and the actor only needs access to the network - not credentials - to reach files that can be turned into account access. With ransomware use listed as unknown, you cannot rule out that outcome when prioritizing the June 26 deadline.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-34909Ubiquiti
- Related
- CVE-2026-34908: Ubiquiti Uni Fi OS Improper Access Control Vulnerability Known Exploited Vulnerabilities · Jun 23, 2026CVE-2026-34910: Ubiquiti Uni Fi OS Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Jun 23, 2026CVE-2010-5330: Ubiquiti AirOS Command Injection Vulnerability Known Exploited Vulnerabilities · Apr 15, 2022