CVE-2026-34908 Details.
UniFi OS - Authentication Bypass via Path Traversal (..%2f)
Atlas does not check this one. Needs a scripted sequence.
This check is a series of requests where each step depends on the last, often after logging in. Atlas runs single, read-only probes, so it does not run this one.
About CVE-2026-34908. What It Means.
UniFi OS devices contain an improper access control vulnerability caused by insufficient authorization checks, letting network attackers make unauthorized system changes, exploit requires network access.
Affected Product. What Is Hit.
The record for CVE-2026-34908 does not name a vendor or product yet.
References. Where To Read More.
- https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908
- https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis
- https://nvd.nist.gov/vuln/detail/CVE-2026-34908
FAQ
Common Questions.
UniFi OS - Authentication Bypass via Path Traversal (..%2f). UniFi OS devices contain an improper access control vulnerability caused by insufficient authorization checks, letting network attackers make unauthorized system changes, exploit requires network access.
No. This check is a series of requests where each step depends on the last, often after logging in. Atlas runs single, read-only probes, so it does not run this one. The facts about CVE-2026-34908 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
Yes. CVE-2026-34908 is on the CISA Known Exploited Vulnerabilities list, which means attackers have used it against real targets.
Update the affected software to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-34908. Atlas does not run a check for it, so nothing here says whether a particular site is affected.