Ubiquiti UniFi OS joins CISA exploit list, forcing federal patches

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three Ubiquiti UniFi OS vulnerabilities to its Known Exploited Vulnerabilities catalog. These critical flaws enable unauthenticated remote attackers to compromise affected networks.

The catalog now includes CVE-2026-34908 for improper access control. It also lists CVE-2026-34909 for path traversal. A third entry, CVE-2026-34910, addresses improper input validation.

CISA directed federal agencies to apply necessary security patches by June 26, 2026. Ubiquiti has released official software updates to mitigate these vulnerabilities.