CVE-2026-34908 in ui unifi os server
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
Affected software: ui unifi os server, ui unifi cloud gateway industrial firmware, ui unifi dream machine firmware, ui unifi dream machine pro firmware, ui unifi dream machine special edition firmware, ui unifi dream machine pro max firmware, ui enterprise fortress gateway firmware, ui unifi dream wall firmware, ui unifi dream router firmware, ui unifi dream router 7 firmware
Scores
- CVSS: 10.0 (critical)
- EPSS: 88.90% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-06-23
- Published: 2026-05-22
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.