CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910 can be chained to give an attacker a root shell on UniFi OS Server without any credentials, user interaction, or prior access, Bishop Fox researchers say.
The three flaws and how they combine
Ubiquiti’s UniFi OS Server contains three vulnerabilities that, when combined, allow an unauthenticated, remote operator to execute code with root privileges. The issues are tracked as CVE-2026-34908 (improper access control), CVE-2026-34909 (path traversal), and CVE-2026-34910 (command injection). All three were assigned the maximum severity rating and were addressed in May; the fixes apply to UniFi OS Server versions 5.0.6 and earlier.
Individually, the CVEs have distinct effects: CVE-2026-34908 permits unauthorized changes through improper access control, CVE-2026-34909 allows disclosure of files via path traversal, and CVE-2026-34910 lets user input reach a shell command. Bishop Fox validated that the three can be chained end-to-end to achieve unauthenticated remote code execution (RCE) on a live UniFi OS Server 5.0.6 instance.
Authentication bypass via URI normalization mismatch
Bishop Fox identified the root cause of the bypass as a mismatch in how UniFi OS evaluates and routes incoming requests. The authentication component checks the raw request URI while Nginx routes requests using a normalized version. By crafting requests that look, in raw form, like they target an authentication-exempt endpoint but that normalize to protected internal routes, an attacker can reach backend services that should not be publicly reachable.
Once the attacker reaches those backend endpoints, the path traversal and command-injection flaws let them pass unvalidated input into a package-update endpoint and execute arbitrary commands. The injected commands initially run under a highly privileged service account; because that account has passwordless sudo access to multiple system binaries, privilege escalation to root is described by the researchers as trivial.
Why root on UniFi OS Server matters
“A UniFi OS Server is not a generic Linux box; it is the management plane for an organization’s network, including, where those devices are deployed, its physical-access doors, surveillance cameras, and the identities tied to them,” Bishop Fox explains. “Root on the appliance is administrative control over everything the console governs.”
Bishop Fox confirmed the chain reaches root, writing: “The chain reaches root (we confirmed it) with no credentials and no user interaction, so there is no failed-login trail to look for.” That absence of authentication events complicates forensic detection of past exploitation.
Bishop Fox detection script and recommended patching
To help defenders, Bishop Fox released a free detection script that safely sends a specially crafted request which traverses the vulnerable code path without executing dangerous commands. The script classifies targets as “vulnerable,” “patched,” “unaffected,” or “inconclusive.”
Importantly, the script does not detect active attacks, historical exploitation, or the presence of persistence mechanisms or backdoors on a target. Bishop Fox warns that confirming a system is uncompromised remains necessary even after applying updates, because the attack does not leave an authentication-failure trail.
Bishop Fox also confirmed the exploit chain does not work on UniFi OS Server 5.0.8, and advises users to upgrade to 5.0.8 or later. The vendor advisory, the researchers note, addressed the vulnerabilities in May but did not mention that the three flaws could be chained for unauthenticated remote code execution.
Operational indicators defenders can watch for
- Requests containing “/api/auth/validate-sso/” (as a possible sign of the crafted requests reaching authentication code paths)
- Requests to “ucs/update/latest_package” (the package-update endpoint targeted for command injection)
- Suspicious child processes spawned under “ucs-update”
- Unexpected sudo commands executed by the service account that runs update-related binaries
These traces are not guaranteed to show prior exploitation, but Bishop Fox lists them as starting points for investigation.
What this means for technologists, procurement leaders, and operators
- Technologists and security teams: Run the Bishop Fox detection script, search logs for the indicators above, and treat systems that are upgraded as potentially already compromised until investigated.
- Affected enterprises and procurement leaders: Confirm that deployed UniFi OS Server instances are running 5.0.8 or later, and require confirmation from operations that updates were applied to uncompromised systems.
- Operators of physical security and identity systems: Prioritize investigation where UniFi OS Server controls physical access, cameras, or identity stores, because root on the appliance yields administrative control over those elements.
The validated chain is compact, silent by design, and—by the researchers’ account—capable of delivering root without authentication or interaction. That combination makes confirmation of patch status and careful post-update forensic checks the most concrete next steps for organizations that run UniFi OS Server.
