CISA has added three critical vulnerabilities in Ubiquiti UniFi OS to its Known Exploited Vulnerabilities (KEV) catalog, with patch deadlines falling today. These flaws carry CVSS scores of 10.0 — the highest possible severity rating — and are confirmed as actively exploited in the wild.

• What it is: Three vulnerabilities in Ubiquiti UniFi OS — CVE-2026-34908 (improper access control), CVE-2026-34909 (path traversal), and CVE-2026-34910 (command injection) — allow attackers with network access to make unauthorised system changes and execute remote commands. A fourth vulnerability in Lantronix EDS5000 serial device servers (CVE-2025-67038) was also added, allowing root-level command execution.
• Who is affected: Any organisation running Ubiquiti UniFi routers, switches, access points, or network controllers. UniFi hardware is widely used in Australian business networks.
• What the risk is: Attackers with network access can take full control of affected devices. In some cases, no authentication is required. These are not theoretical risks — CISA's KEV catalog only includes vulnerabilities with confirmed active exploitation.
• What action is needed: Log in to your UniFi Network controller and update all devices to the latest available firmware immediately. Check Ubiquiti's security advisories for the minimum patched version for each product line.

If you are unsure whether your environment is affected or patched, contact us and we can review your network devices. Do not leave this one — CVSS 10.0 flaws with active exploitation require same-day attention.

Sources: CISA KEV Alert — June 23, 2026 | Security Affairs