Ubiquiti

Vulnerability activity for Ubiquiti: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 4
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 4
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 7
Critical (CVSS 9+): 3
Exploited (CISA KEV): 3
With exploit code: 3

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

10.0CriticalJun 23, 2026Ubiquiti UniFi OS Auth bypass / access controlCVE-2026-34908Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.Added to KEV Jun 23, 2026Exploited88% likelyExploit codeNucleiDetection
10.0CriticalJun 23, 2026Ubiquiti UniFi OS Path traversal / file handlingCVE-2026-34909Affected: Ubiquiti UniFi OS versions prior to 7.5.38. Attacker gains: Remote code execution and arbitrary file access. Recommended action: Update UniFi OS to version 7.5.38 or later.Added to KEV Jun 23, 2026Exploited68% likelyExploit codeDetection
10.0CriticalJun 23, 2026Ubiquiti UniFi OSCVE-2026-34910Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.Added to KEV Jun 23, 2026Exploited90% likelyExploit codeNucleiDetection
9.8CriticalJun 11, 2019Ubiquiti AirOS Code / command injectionCVE-2010-5330Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.Added to KEV Apr 15, 2022 · 1,038 days after publicationExploited40% likely

Recent

7.1HighOct 27, 2026Ubiquiti airMAX M CSRFCVE-2026-116839A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.
8.8HighOct 27, 2026Ubiquiti airMAX M CSRFCVE-2026-116838A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
8.8HighOct 27, 2026Ubiquiti airMAX M Memory corruptionCVE-2026-116837A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
8.8HighOct 27, 2026Ubiquiti airMAX M XSSCVE-2026-116836A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.
10.0CriticalJun 23, 2026Ubiquiti UniFi OSCVE-2026-34910Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.Exploited90% likelyExploit codeNucleiDetection
10.0CriticalJun 23, 2026Ubiquiti UniFi OS Path traversal / file handlingCVE-2026-34909Affected: Ubiquiti UniFi OS versions prior to 7.5.38. Attacker gains: Remote code execution and arbitrary file access. Recommended action: Update UniFi OS to version 7.5.38 or later.Exploited68% likelyExploit codeDetection
10.0CriticalJun 23, 2026Ubiquiti UniFi OS Auth bypass / access controlCVE-2026-34908Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.Exploited88% likelyExploit codeNucleiDetection
9.8CriticalJun 11, 2019Ubiquiti AirOS Code / command injectionCVE-2010-5330Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.Exploited40% likely

See every Ubiquiti entry on the dashboard.