Unauthenticated path traversal in Ubiquiti UniFi OS exposes system files and enables account takeover (CVE-2026-34909)
A public exploit is available in VulnCheck XDB and new reporting this week (BleepingComputer 2026-09-22) again cites the flaw as exploited, so any gateway or console still below the fixed UniFi OS release is exposed to unauthenticated account compromise of the device that fronts the network.
A path traversal flaw in UniFi OS lets a network-reachable attacker with no credentials read files on the underlying system, including material that can be used to take over an account on the device. It affects UniFi OS Server, Express, the Dream Machine family (UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast), EFG, UDW and UDR.
Affected: Ubiquiti UniFi OS Server < 5.0.8; Ubiquiti Express < 4.0.14; Ubiquiti UDM < 5.1.12; Ubiquiti UDM-Pro < 5.1.12; Ubiquiti UDM-SE < 5.1.12; Ubiquiti UDM-Pro-Max < 5.1.12; Ubiquiti UDM-Beast < 5.1.11; Ubiquiti EFG < 5.1.12; Ubiquiti UDW < 5.1.12; Ubiquiti UDR < 5.1.12
How to Test
On each console check the UniFi OS version: UniFi OS Server below 5.0.8, Express below 4.0.14, UDM/UDM-Pro/UDM-SE/UDM-Pro-Max/EFG/UDW/UDR below 5.1.12, and UDM-Beast below 5.1.11 are vulnerable. Review the device's web access logs for traversal sequences (../) in request paths to the UniFi OS management interface, especially from external addresses, and audit local accounts, SSH keys, scheduled tasks and running processes for anything not created by administrators.
How to Patch
Update to UniFi OS Server 5.0.8, Express 4.0.14, UDM-Beast 5.1.11, and 5.1.12 for UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW and UDR. Until updated, block access to the UniFi OS management interface from the internet and untrusted networks.