CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation

Exploited in the wild Critical 10.0 Published 22 May 2026 Updated 24 Jun 2026

A network-based attacker can execute arbitrary commands on Ubiquiti UniFi OS devices due to improper input validation.

Exploited in the wild: Since 23 Jun 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-34910?

CVE-2026-34910 is a critical command injection vulnerability in Ubiquiti Inc EFG, published on 22 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

Weakness: CWE-20

Which versions are affected by CVE-2026-34910?

It affects 31 products.

Products include Ui Enterprise Fortress Gateway Firmware, Ui Enterprise Network Video Recorder Core Firmware, Ui Enterprise Network Video Recorder Firmware, Ui Unas 2 Firmware, Ui Unas 4 Firmware, Ui Unas Pro 4 Firmware and 25 more.

How do I fix CVE-2026-34910?

No fix has been published for CVE-2026-34910 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 26 Jun 2026.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-34910 being exploited?

Yes. Attackers have exploited CVE-2026-34910 in the wild since at least 23 Jun 2026.

Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.

Sources

Also known as GHSA-fvgm-jgwh-qwx7.