{"cve_id":"CVE-2026-34909","published":"2026-05-22T02:16:34.390000+00:00","last_modified":"2026-07-23T16:10:00.137000+00:00","vuln_status":"Analyzed","description":"A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","base_score":10.0,"base_severity":"CRITICAL","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"CHANGED","impact_c":"HIGH","impact_i":"HIGH","impact_a":"HIGH","cwe_ids":["CWE-22"],"in_kev":true,"kev_date_added":"2026-06-23","kev_ransomware":false,"epss_score":0.68033,"epss_percentile":0.99324,"cap_rule_version":"0.1.1","stage":"INITIAL_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"PRIV","caps":["CODE_EXEC","INFO_DISCLOSURE","PRIV_GAIN"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T12:14:49.757152+00:00","first_seen":"2026-05-22T02:16:34.390000+00:00","kev_first_seen":"2026-06-23T00:00:00+00:00","novelty_score":56.59,"novelty_reasons":["EPSS_SPIKE","HIGH_LEVERAGE_STEPPING_STONE","REACHES_TERMINAL"],"novelty_at":"2026-11-02T03:21:44.260683+00:00","vendors":["ui"],"products":["enterprise_fortress_gateway","enterprise_fortress_gateway_firmware","enterprise_network_video_recorder","enterprise_network_video_recorder_core","enterprise_network_video_recorder_core_firmware","enterprise_network_video_recorder_firmware","unas_2","unas_2_firmware","unas_4","unas_4_firmware","unas_pro","unas_pro_4","unas_pro_4_firmware","unas_pro_8","unas_pro_8_firmware","unas_pro_firmware","unifi_cloud_gateway_fiber","unifi_cloud_gateway_fiber_firmware","unifi_cloud_gateway_industrial","unifi_cloud_gateway_industrial_firmware","unifi_cloud_gateway_max","unifi_cloud_gateway_max_firmware","unifi_cloud_gateway_ultra","unifi_cloud_gateway_ultra_firmware","unifi_cloud_key_plus","unifi_cloud_key_plus_firmware","unifi_cloudkey","unifi_cloudkey_enterprise","unifi_cloudkey_enterprise_firmware","unifi_cloudkey_firmware","unifi_dream_machine","unifi_dream_machine_beast","unifi_dream_machine_beast_firmware","unifi_dream_machine_firmware","unifi_dream_machine_pro","unifi_dream_machine_pro_firmware","unifi_dream_machine_pro_max","unifi_dream_machine_pro_max_firmware","unifi_dream_machine_special_edition","unifi_dream_machine_special_edition_firmware","unifi_dream_router","unifi_dream_router_5g_max","unifi_dream_router_5g_max_firmware","unifi_dream_router_7","unifi_dream_router_7_firmware","unifi_dream_router_firmware","unifi_dream_wall","unifi_dream_wall_firmware","unifi_express","unifi_express_7","unifi_express_7_firmware","unifi_express_firmware","unifi_network_video_recorder","unifi_network_video_recorder_firmware","unifi_network_video_recorder_g2","unifi_network_video_recorder_g2_firmware","unifi_network_video_recorder_g2_pro","unifi_network_video_recorder_g2_pro_firmware","unifi_network_video_recorder_instant","unifi_network_video_recorder_instant_firmware","unifi_network_video_recorder_pro","unifi_network_video_recorder_pro_firmware","unifi_os_server"],"affected":[{"vendor":"ui","product":"enterprise_fortress_gateway_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"enterprise_network_video_recorder_core_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"enterprise_network_video_recorder_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unas_2_firmware","ranges":["< 5.1.10"]},{"vendor":"ui","product":"unas_4_firmware","ranges":["< 5.1.10"]},{"vendor":"ui","product":"unas_pro_4_firmware","ranges":["< 5.1.10"]},{"vendor":"ui","product":"unas_pro_8_firmware","ranges":["< 5.1.10"]},{"vendor":"ui","product":"unas_pro_firmware","ranges":["< 5.1.10"]},{"vendor":"ui","product":"unifi_cloud_gateway_fiber_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_cloud_gateway_industrial_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_cloud_gateway_max_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_cloud_gateway_ultra_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_cloud_key_plus_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_cloudkey_enterprise_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_cloudkey_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_dream_machine_beast_firmware","ranges":["< 5.1.11"]},{"vendor":"ui","product":"unifi_dream_machine_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_dream_machine_pro_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_dream_machine_pro_max_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_dream_machine_special_edition_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_dream_router_5g_max_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_dream_router_7_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_dream_router_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_dream_wall_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_express_7_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_express_firmware","ranges":["< 4.0.14"]},{"vendor":"ui","product":"unifi_network_video_recorder_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_network_video_recorder_g2_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_network_video_recorder_g2_pro_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_network_video_recorder_instant_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_network_video_recorder_pro_firmware","ranges":["< 5.1.12"]},{"vendor":"ui","product":"unifi_os_server","ranges":["< 5.0.8"]}]}