What are the Ubiquiti UniFi OS CVEs from June 2026 and why do they matter to Hawaii businesses?

CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 are three separate flaws in Ubiquiti UniFi OS that can be chained to give an unauthenticated remote attacker root access on UniFi gateways, consoles, and NVRs. All three carry a CVSS score of 10.0. CISA added them to the Known Exploited Vulnerabilities catalog on June 23, 2026 with a due date of July 14. UniFi is one of the most common SMB networking platforms in Hawaii, which is why this advisory matters.

Which UniFi devices are affected by CVE-2026-34908, 34909, and 34910?

UniFi OS Server (the self-hosted controller software) and UniFi appliances that run UniFi OS as their operating system are in scope. That includes UniFi Cloud Keys, UniFi Dream Machine (UDM, UDM-Pro, UDM-SE), UniFi Dream Router, UniFi Express, UniFi Network Video Recorders (UNVR, UNVR-Pro), and UniFi Access consoles. Standalone UniFi switches and access points that run UniFi Network firmware only are not directly affected by these three CVEs.

What version of UniFi OS fixes CVE-2026-34908, 34909, and 34910?

UniFi OS 5.0.8 is the fixed release for UniFi OS Server. Each appliance family (Cloud Key, Dream Machine, Dream Router, Express, NVR, Access) has its own current fixed build listed in Ubiquiti's security advisory. Hawaii businesses running any UniFi console, gateway, or NVR should check the UniFi OS version in the UI or via SSH and update to the current fixed build before July 14, 2026 at the latest.

Is CVE-2026-34908 already being exploited in the wild?

Yes. CISA does not add a vulnerability to the KEV catalog without evidence of active in-the-wild exploitation. The Ubiquiti chain was added on June 23, 2026, which is CISA's confirmation that attackers are already using it. Public proof-of-concept exploit code circulates in the days following any KEV addition. Every Hawaii UniFi console reachable from the internet should be considered a target as of the KEV date.

What should a Hawaii business do if the UniFi console is behind a firewall and not directly on the internet?

Patch anyway. The exploit only requires network reachability to the UniFi console's management interface, so any device that reaches the console (a compromised office workstation, a guest Wi-Fi client that pivoted, an infected phone on the same VLAN) can carry the exploit inward. UniFi consoles left on the same VLAN as workstations are one credential phish away from being reachable. Patch on the July 14 deadline at the latest, and verify the update completed.

Does the July 14 CISA KEV due date apply to a Hawaii private business?

The 21-day BOD 22-01 timeline is only mandatory for U.S. federal civilian agencies. It is not a legal requirement for a Hawaii private business. That said, insurers, auditors, and enterprise customers increasingly treat CISA KEV due dates as the reasonable-care benchmark. A Hawaii business that patches after a public breach and cannot show KEV alignment is in a much weaker position with insurance and litigation. Use July 14, 2026 as the working deadline.

Published July 9, 2026 · HI Tech Hui · ~8 min read

Ubiquiti UniFi OS CVE-2026-34908/34909/34910: what Hawaii businesses need to do right now

Three separate CVSS 10.0 flaws in Ubiquiti UniFi OS were added to the CISA Known Exploited Vulnerabilities catalog on June 23, 2026 with a federal due date of July 14. Chained, they let an unauthenticated attacker reach root on UniFi gateways, consoles, and NVRs. Hawaii businesses running UniFi — one of the most common SMB networking platforms across the islands — should treat this as an emergency patch window and update to UniFi OS 5.0.8 (or the current fixed build for each appliance) this week.

Why this advisory matters more in Hawaii than the CVE number suggests

UniFi is not a niche platform in Hawaii. Ubiquiti gear runs the network in a large share of the state's small offices, medical practices, law firms, construction shops, restaurants, and boutique properties. The reasons are practical — the price point works for a five-to-fifty-person business, the hardware is available at big-box stores, and the UniFi UI is friendlier than a Cisco or Juniper equivalent for a non-network-engineer. Every one of those Hawaii SMBs is now in scope for CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910.

The three vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog on June 23, 2026 with a due date of July 14, 2026 — the standard 21-day BOD 22-01 window for previously-known CVEs. That due date is a legal mandate for federal civilian agencies. For Hawaii SMBs it is not a legal deadline, but it is quickly becoming the reasonable-care benchmark used by insurers, auditors, and enterprise customers when they evaluate a business after an incident.

What are CVE-2026-34908, 34909, and 34910?

All three are flaws in Ubiquiti UniFi OS, the operating system that runs on UniFi consoles, gateways, and network video recorders. Each carries a base CVSS score of 10.0.

CVE-2026-34910 — Command Injection. An unauthenticated remote attacker can inject arbitrary shell commands into a specific management endpoint. This is the code-execution primitive at the end of the chain.
CVE-2026-34909 — Path Traversal. Allows reading and writing files outside the intended directory. In combination with 34910, an attacker can drop a payload anywhere on the file system.
CVE-2026-34908 — Improper Access Control. Removes authentication guardrails on affected endpoints so the other two flaws are reachable without credentials.

Chained, the three flaws produce an unauthenticated remote root primitive against any UniFi console that exposes the management interface to a reachable network. Post-exploitation, the attacker can clear local device logs to make the intrusion invisible to a casual review of the UniFi UI. That last property is what makes this chain especially dangerous — a Hawaii SMB running an unpatched UniFi console today may already be compromised and not see any evidence in the console logs.

Which UniFi devices are affected?

The affected products are UniFi appliances and software that run UniFi OS as the operating system, not the standalone UniFi Network firmware that runs on switches and access points.

UniFi OS Server (self-hosted controller software).
UniFi Cloud Key generations 1 and 2, and Cloud Key Gen 2 Plus.
UniFi Dream Machine, Dream Machine Pro, Dream Machine SE.
UniFi Dream Router, UniFi Express.
UniFi Network Video Recorders — UNVR, UNVR-Pro.
UniFi Access consoles.

Standalone UniFi switches and access points that only run UniFi Network firmware (not UniFi OS) are not directly in scope for these three CVEs. They still depend on the console for adoption and management, so a compromised console is a compromised network.

How does the exploit chain work in practice?

The attacker needs network reachability to the UniFi OS management interface — usually the HTTPS port on the console. That is the only precondition. From there:

The improper access control flaw (34908) exposes management endpoints that should have required authentication.
The path traversal flaw (34909) is used to read configuration files or drop attacker-controlled files into system directories.
The command injection flaw (34910) executes arbitrary shell commands as root.

Post-exploitation, the observed pattern includes wiping local device logs, installing a persistent remote access agent, and pivoting to attached UniFi devices (switches, access points, cameras). A Hawaii business that only reviews the UniFi UI after an incident will not see the attacker's footprint. External logging — a syslog collector, an XDR platform, or a network-flow tool — is the only reliable evidence source.

What Hawaii businesses need to do this week

Five steps, in order.

1. Inventory every UniFi console, gateway, and NVR

Not just the ones the office manager remembers. Include the UniFi Dream Machine in the storage closet, the Cloud Key on the shelf in the server room, the UNVR under the front desk, and any secondary console at a remote site or neighbor-island office. The CISA KEV patching SLA discipline starts with an accurate inventory.

2. Check the UniFi OS version on every affected device

Log into each console, open Settings, and confirm the UniFi OS version. UniFi OS 5.0.8 is the fixed release for UniFi OS Server. Each appliance family has its own current fixed build listed in Ubiquiti's release notes and security advisories. Any device on a build older than the fixed version is vulnerable.

3. Patch to the current fixed build

Update through the UniFi UI or via the Ubiquiti update mechanism. Reboots are required for most appliances. Schedule the reboot during a low-impact window — for a Hawaii retail or hospitality property, that usually means late night or early morning HST. Confirm the version increments after reboot. Do not accept "update pending" as complete.

4. Restrict management interface exposure

Even after patching, the UniFi management interface does not need to be reachable from the internet or from the guest VLAN. Firewall rules should limit management access to a specific admin VLAN or a jump host. Any Hawaii business that has a UniFi console with a public HTTPS port open should close it today. Remote management can be done through the Ubiquiti account cloud connection or a VPN.

5. Hunt for prior compromise

If the console has been reachable from the internet, or if the management interface has been on a shared VLAN with any guest or IoT device, assume the possibility of prior compromise and hunt. The tell-tale signals to look for:

Unfamiliar admin accounts, or existing admin accounts with a modified role or an unexpected last-login timestamp.
Unexpected outbound connections from the console to unknown IP addresses, especially over uncommon ports.
Missing time ranges in the console logs — a gap where the log stream skips forward is a strong indicator of a wipe.
New SSH keys in the appliance configuration or authorized_keys files that no team member added.
Configuration changes that no one on the team recalls making, including new firewall rules, new VPN users, or new port-forwards.
Firmware or UniFi OS version rolled back to an older build (attackers sometimes downgrade to preserve their access after a security patch is released).

Escalate any anomaly to the MSP or in-house IT team. Do not attempt cleanup on a compromised UniFi console without preserving forensic evidence — the syslog stream, a configuration export, and a full backup file are what an incident responder will need. The same discipline our Hawaii ransomware recovery guide uses applies here.

How this fits into the broader 2026 Hawaii patching picture

Ubiquiti joins Ivanti, Cisco, Check Point, Palo Alto, and SolarWinds in the June-and-July 2026 wave of KEV-listed enterprise infrastructure vulnerabilities. The pattern is consistent — attackers are targeting network edge and management consoles because they are widely deployed, often forgotten after initial install, and rarely on a strict patch cadence. Our recent write-up on the Ivanti Sentry unauth root CVE makes the same case with a different vendor.

The defensible position for a Hawaii SMB is not perfect patching — it is a defined SLA that maps to the KEV catalog. Critical KEV items patched within seven days. High KEV items within fourteen. Everything else within thirty. A written policy, an owner, and monthly evidence of what got patched. Insurers now ask for exactly that at renewal, and it is a small share of the twelve controls in our 2026 Hawaii cyber-insurance renewal checklist.