UniFi OS Security Advisory: 5 Critical Vulnerabilities (Command Injection, Path Traversal) with Patch Details

UniFi Security Advisory Bulletin 064 Vulnerability Summary Vulnerability Overview This bulletin contains 5 security vulnerabilities affecting UniFi OS devices, primarily involving command injection, improper access control, and path traversal issues. Attackers exploiting these vulnerabilities can execute arbitrary commands, perform unauthorized system modifications, or obtain sensitive information. Affected Scope Affected Products: UniFi OS Server: Version 5.8.6 and earlier UCG-Industrial: Version 5.0.13 and earlier UDM Series: UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCO-Ultra, UCO-Max, and UCO-Fiber (Version 5.0.16 and earlier) UDR Series: UDR-5G, ENVR-Core, UCKP, UCK, and UCK-Enterprise (Version 5.0.17 and earlier) UNVR Series: UNVR-G2 and UNVR-G2-Pro (Version 5.1.11 and earlier) UNAS Series: UDM-Beast, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, and UNAS-Pro-8 (Version 5.1.8 and earlier) Remediation Please upgrade the firmware to the following versions based on the specific device model: UCG-Industrial: Version 5.1.12 or later UDM Series: Version 5.1.12 or later UDR Series: Version 5.1.12 or later UniFi OS Server: Version 5.8.8 or later UNVR Series: Version 5.1.12 or later UNAS Series: Version 5.1.18 or later UDM-Beast: Version 5.1.11 or later Vulnerability Details 1. Command Injection Description: A malicious attacker can exploit improper input validation to execute command injection. CVSS Score: 9.1 (Critical) CVE ID: CVE-2026-33888 2. Improper Access Control Description: A malicious attacker can exploit an access control vulnerability to make unauthorized changes to the system. CVSS Score: 10.0 (Critical) CVE ID: CVE-2026-34988 3. Path Traversal Description: A malicious attacker can exploit a path traversal vulnerability to access underlying system files, thereby manipulating underlying accounts. CVSS Score: 10.0 (Critical) CVE ID: CVE-2026-34989 4. Command Injection Description: A malicious attacker can exploit improper input validation to execute command injection. CVSS Score: 10.0 (Critical) CVE ID: CVE-2026-34910 5. Path Traversal Description: A malicious attacker can exploit a path traversal vulnerability to access underlying system files to obtain sensitive information. CVSS Score: 7.7 (High) CVE ID: CVE-2026-34911

Goal Reached Thanks to every supporter — we hit 100%!

UniFi OS Security Advisory: 5 Critical Vulnerabilities (Command Injection, Path Traversal) with Patch Details