Ubiquiti released a security update for UniFi OS on May 22 addressing five vulnerabilities, three of which carry the highest possible CVSS score of 10. The flaws require no authentication and no user interaction to exploit, and they expose the underlying operating system of affected UniFi OS devices to complete remote takeover.

The three maximum-severity vulnerabilities are CVE-2026-34908, an improper access control flaw that allows an attacker on the same network to make unauthorised changes to the system; CVE-2026-34909, a path traversal vulnerability giving access to underlying system files; and CVE-2026-34910, an improper input validation bug enabling full command injection. Two additional vulnerabilities were also patched: CVE-2026-33000, a second critical command injection flaw, and CVE-2026-34911, a high-severity information disclosure issue.

All five vulnerabilities were discovered and responsibly disclosed through Ubiquiti’s bug bounty programme. As of publication there is no confirmed active exploitation in the wild and no public proof-of-concept code, but the low attack complexity and complete absence of authentication requirements mean exploitation is straightforward once an attacker understands the flaw.

The exposure scope is significant. Censys is tracking close to 100,000 internet-accessible UniFi OS endpoints, the majority located in the United States. Ubiquiti hardware is widely deployed across small businesses, retail environments, offices, and managed network installations precisely because it offers enterprise-grade features at accessible price points. Many of those deployments have management interfaces reachable from the internet, either by configuration choice or by default.

The pattern here is familiar: a hardware platform popular for its cost-to-performance ratio accumulates deployments where internet exposure is normalised rather than locked down, and when critical vulnerabilities land, the affected surface is enormous. The absence of current exploitation is not a reason to delay patching. The window between disclosure and weaponisation has been shrinking for years, particularly for network infrastructure where compromising a single device gives an attacker a persistent foothold behind the perimeter.

Update all UniFi OS devices to the latest firmware immediately and audit which management interfaces are reachable from outside your trusted network. Devices that do not require internet-accessible management should have that access removed at the firewall level.

If you are unsure which network devices in your environment are internet-exposed, or you want an independent review of your network security posture, contact Excello Digital and we will map your exposure and help you close the gaps.