CVE WatchJul 23, 2026

CVE-2026-34910

Ubiquiti UniFi OS Improper Input Validation Vulnerability

CVSS

10.0

Critical

EPSS

45.8%

p99

KEV

YES

Jun 23, 2026

Exploit Today

0-100

Published: May 22, 2026 · Last modified: Jul 23, 2026 · CWE-20

EPSS · 30d

45.8%EPSS · 30 days87.5%

2026-09-162026-10-14

KEV catalog record

Product

Ubiquiti / UniFi OS

Vulnerability

Ubiquiti UniFi OS Improper Input Validation Vulnerability

Added to KEV

Jun 23, 2026

Remediate by

Jun 26, 2026

Known ransomware use

Summary description

Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Notes

https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-34910

Technical description

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-798218.2 HIG

—

———A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down.4h CVE-2026-766617.6 HIG

—

———A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.9h CVE-2026-766608.7 HIG

—

———A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.9h CVE-2026-1108705.3 MED

—

——0Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.12h CVE-2026-732617.5 HIG

—

——0Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.16h CVE-2026-539997.7 HIG

—

——0Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.15h