Name: CVE-2026-34909: Improper Limitation of a Pathname to a Restricted Directory
Creator: Rapid7
Published: 2026-05-22T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-34909, CWE-22, Exploited in the Wild, CISA KEV Exploit, CVSS 10, EPSS 0.01793, CISA KEV

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

CVSS Details

CVSS 3.1 Base Score: 10
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Ubiquiti Unifi	—	Upgrade to the latest secure UniFi OS version for UDM-SEUpgrade to the latest secure UniFi OS version for UDR (Dream Router)Upgrade to the latest secure UniFi OS version for UDM-Pro-MaxUpgrade to the latest secure UniFi OS version for UCG-IndustrialUpgrade to the latest secure UniFi OS version for UCG-FiberUpgrade to the latest secure UniFi OS version for UCG-MaxUpgrade to the latest secure UniFi OS version for UCG-UltraUpgrade to the latest secure UniFi OS version for UDM (Dream Machine)	Jul 7, 2026	May 21, 2026
Ubiquiti Unifi Ucg Fiber	—	Upgrade to the latest secure UniFi OS version for UCG-Fiber	Jul 7, 2026	May 21, 2026
Ubiquiti Unifi Ucg Industrial	—	Upgrade to the latest secure UniFi OS version for UCG-Industrial	Jul 7, 2026	May 21, 2026
Ubiquiti Unifi Ucg Max	—	Upgrade to the latest secure UniFi OS version for UCG-Max	Jul 7, 2026	May 21, 2026
Ubiquiti Unifi Ucg Ultra	—	Upgrade to the latest secure UniFi OS version for UCG-Ultra	Jul 7, 2026	May 21, 2026
Ubiquiti Unifi Udm	—	Upgrade to the latest secure UniFi OS version for UDM (Dream Machine)	Jul 7, 2026	May 21, 2026
Ubiquiti Unifi Udm Pro	—	Upgrade to the latest secure UniFi OS version for UDM-Pro	Jul 7, 2026	May 21, 2026
Ubiquiti Unifi Udm Pro Max	—	Upgrade to the latest secure UniFi OS version for UDM-Pro-Max	Jul 7, 2026	May 21, 2026
Ubiquiti Unifi Udm Se	—	Upgrade to the latest secure UniFi OS version for UDM-SE	Jul 7, 2026	May 21, 2026
Ubiquiti Unifi Udr	—	Upgrade to the latest secure UniFi OS version for UDR (Dream Router)	Jul 7, 2026	May 21, 2026
Ubiquiti Unifi Udr7	—	Upgrade to the latest secure UniFi OS version for UDR7	Jul 7, 2026	May 21, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence