Ubiquiti UniFi OS: Three CVSS 10.0 Flaws Enable Unauthenticated Root Access, Patch Now

The UniFi OS unauthenticated RCE attack requires no prior access and executes in three stages, each corresponding to a distinct CVE. BishopFox researchers mapped the chain after acquiring a UniFi OS Server instance for analysis and published their findings alongside a safe detection tool at github.com/BishopFox/CVE-2026-34908-check.

CVE-2026-34908 and CVE-2026-34909 form the authentication bypass stage. Ubiquiti's NGINX gateway authenticates requests by checking two representations of the incoming URI: the raw form, which is percent-encoded exactly as the client sent it, and the normalized form, which NGINX decodes and collapses before routing. The authentication exemption logic examines the raw URI for exempt patterns like /api/auth/validate-sso/. NGINX routes based on the normalized version. An attacker sends a request whose raw URI begins with the exempt prefix but whose normalized form resolves to an authenticated internal endpoint. The gateway passes the auth check on the raw URI and routes the request to the internal backend, which assumes authentication was already verified.

Once past the access gate, CVE-2026-34910 delivers command injection. The package-update endpoint accepts a package name and passes it unsanitized to a shell command: sudo /usr/bin/uos runnable latest-versions [package-name]. Shell metacharacters in the parameter execute as arbitrary OS commands. The service account running this code is ucs-update, which holds passwordless sudo access to /usr/bin/dpkg, /bin/chmod, and /bin/systemctl. BishopFox confirmed root access by building a malicious .deb package and installing it via sudo dpkg, which executes post-install scripts as root.

A comparable NGINX URI normalization bypass appeared in the NGINX Rift CVE-2026-42945 unauthenticated RCE disclosure. The UniFi OS chain is more severe because the downstream injection reaches root-privileged sudo calls that control the device's entire security stack.

Censys tracked nearly 100,000 UniFi OS endpoints reachable over the public internet as of June 2026. Approximately 50,000 of those endpoints were located in the United States. The web interface commonly exposes TCP 11443, which BishopFox confirmed as the standard attack surface for this chain.

The affected device classes span the entire UniFi OS product line: Cloud Gateways including the Dream Machine family, Network Controllers including UCK-G2 and UCK-G2-Plus, Protect Network Video Recorders including UNVR and UNVR Pro, Access Hubs for physical access control, and Talk appliances. All UniFi OS Server versions 5.0.6 and below running unifi-core package version 5.0.126 or below are vulnerable.

The vulnerability chain does not require local network access. Ubiquiti's advisory specifies the attack vector as 'network' for all three CVEs, meaning any host that can reach the UniFi OS web interface over the public internet can exploit the bypass. This is a critical distinction from vulnerabilities that require adjacent network position. The 100,000 internet-facing endpoints represent the immediate attack surface; additional internal deployments reachable from a compromised network segment face exposure through lateral movement via the same chain.

CISA's BOD 26-04 mandate set a three-day deadline from the June 23 KEV addition, which expires today. Federal civilian agencies that have not patched are out of compliance. The same urgency applies to every private-sector organization: active exploitation confirmed by CISA means threat actors are scanning TCP 11443 at scale right now.

Root access on a UniFi OS Server is not limited to the device itself. UniFi OS serves as the authentication and configuration hub for every network device, camera, and physical access controller it manages, so a single compromise yields credentials for the entire managed network.

From root on a compromised UniFi OS Server, an attacker extracts JWT signing keys used for session token generation. UniFi OS uses symmetric HS256 signing for these tokens, meaning the key is shared and stored on disk. An attacker with the key can forge valid administrator tokens offline. These forged tokens remain valid even after patching because the update does not rotate the signing key. Rotation requires a manual reboot step. Attackers retain a persistent authentication path even after the patch closes the initial entry point.

Additional credentials available at root include TLS certificates and private keys, cloud authentication tokens used for multi-site remote management, the complete user database, WiFi pre-shared keys and RADIUS server secrets, VPN configurations, NFC credentials, and biometric templates enrolled via UniFi Access physical door controllers.

Active exploitation observed during reconnaissance created rogue administrator accounts under the username 'John Sim.' This naming pattern across multiple organizations indicates a scripted payload deploying a persistent backdoor before pivoting to targeted activity. The account creation is the earliest indicator that automated exploitation has run on a given device.

The parallel to Check Point VPN CVE-2026-50751 is instructive: in that incident, organizations that patched but did not audit post-compromise credential use discovered weeks later that attackers had harvested VPN session credentials before the patch window and maintained persistent access through stolen tokens.

Detecting successful exploitation of the UniFi OS unauthenticated RCE chain requires searching across both network-level access logs and host-level process records. BishopFox documented the specific request patterns that distinguish exploitation attempts from legitimate traffic.

The primary network-level indicator is HTTP requests to the UniFi OS web interface containing the bypass pattern: requests whose URI begins with /api/auth/validate-sso/ followed by percent-encoded path traversal sequences, specifically ..%2f or %2e%2e. These sequences normalize to authenticated internal routes but pass the authentication exemption check. A single such request in your web server access logs indicates an exploitation attempt. An HTTP 200 response indicates a successful authentication bypass.

The secondary indicator covers the command injection phase: requests to /ucs/update/latest_package containing shell metacharacters in the parameter field, including dollar signs, semicolons, ampersands, backticks, or pipe characters. These indicate active CVE-2026-34910 exploitation attempts.

At the host level, four specific signs indicate post-exploitation activity: any administrator account named 'John Sim' in the UniFi OS user database, unexpected child processes spawned under the ucs-update service account, sudo dpkg or sudo chmod calls initiated by ucs-update with non-standard arguments, and .deb package installations not initiated through the standard update interface.

BishopFox's detection tool sends the bypass request without executing any commands and reports HTTP 200 (vulnerable) or HTTP 400 (patched). It confirms current vulnerability only, not whether past exploitation occurred. Any device that was internet-accessible before today must be treated as potentially compromised regardless of detection tool output.

The UniFi OS unauthenticated RCE vulnerability closes with a firmware update followed by a set of post-patch hardening steps. Patching without the hardening steps leaves organizations exposed to attacker persistence established before the patch window.

Step 1 blocks active exploitation. Steps 2 through 7 address the credential and access persistence that survives a patch-only response.

The UniFi OS unauthenticated RCE vulnerability matters because UniFi hardware occupies a high-trust position in network architecture that most endpoint security tools do not monitor. A compromised network controller manages the security boundaries of every device behind it, not just its own operation.

UniFi hardware is deployed across a wide range of environments: small and medium businesses using it as primary network infrastructure, enterprise branch offices, hospitality and retail locations managing guest WiFi, schools and universities, healthcare facilities running UniFi Protect for physical security cameras, and facilities managing physical door access through UniFi Access controllers. In every deployment, the UniFi OS Server holds credentials that authenticate to downstream systems across the organization.

The attack physics differ from software vulnerabilities at the application layer. An attacker who gains root on a UniFi Network Controller can push configuration changes to all managed switches, access points, and gateways simultaneously. A single compromised controller can silently redirect DNS resolution across the managed network, insert rogue VLAN rules, or disable firewall policies without generating process-level alerts that endpoint detection tools watch for on servers and workstations.

The three-day CISA deadline expired today. Organizations that treat CISA KEV notifications as a starting gun are already in a reactive posture. Exploitation was confirmed before the June 23 KEV addition, which means attackers were scanning TCP 11443 before the deadline began. The 100,000 internet-facing UniFi OS endpoints Censys tracks span every sector, and the scan rate against this attack surface increases after CISA publications make the vulnerability broadly known.

The remediation window before the weekend closes today. Any UniFi OS Server reachable from the internet on firmware older than 5.0.8 is an open door.