Ubiquiti has published Security Advisory Bulletin 064 for UniFi OS and fixed five vulnerabilities, including three critical CVSS 10.0 issues. The practical takeaway is direct: if you run a UniFi Cloud Gateway, Dream Machine, Cloud Key, NVR, NAS, Express, or UniFi OS Server, verify the installed UniFi OS branch and update to the fixed version named by Ubiquiti [1].
The advisory does not say the flaws are being exploited in the wild. That is still not a reason to wait. Several of the bugs are reachable from the network without authentication, and the impact includes unauthorized system changes, path traversal, and command injection. For a home lab, office, MSP customer, or small business, UniFi OS often sits in front of routing, VPN, cameras, access points, and management traffic.
Who is affected
This is not a single-device advisory. Ubiquiti lists several UniFi OS product lines, and the version thresholds differ by device family. Prioritize devices whose management interfaces are reachable from internal networks, VPN users, or any internet-exposed path.
| Product group | Vulnerable version threshold | Fixed version to install |
|---|---|---|
| UniFi OS Server | 5.0.6 and earlier | 5.0.8 or later |
| UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber | 5.0.16 and earlier | 5.1.12 or later |
| UDR-5G, ENVR-Core, UCKP, UCK, UCK-Enterprise | 5.0.17 and earlier | 5.1.12 or later |
| UNVR-G2 and UNVR-G2-Pro | 5.1.11 and earlier | 5.1.12 or later |
| UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8 | 5.1.8 and earlier | 5.1.10 or later |
| Express | 4.0.13 and earlier | 4.0.14 or later |
What the CVEs mean in practice
The highest-priority entries are CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. Ubiquiti describes them as network-reachable issues that do not require prior authentication and carry full confidentiality, integrity, and availability impact. In plain terms, a vulnerable management plane can become a route to system changes or sensitive files if an attacker can reach it.
CVE-2026-33000 is narrower because it requires high privileges and applies to UniFi OS Server, but it can still lead to command injection. CVE-2026-34911 has a lower score, yet it can expose sensitive information to a low-privileged network attacker. The response should be patch-first, then check whether the device configuration still matches what you expect.
What to do now
- Inventory every UniFi OS device. Check Cloud Gateways, Dream Machines, Cloud Keys, NVRs, NAS appliances, Express devices, and any separate UniFi OS Server. Do not rely only on the main controller view.
- Install the fixed UniFi OS release. UniFi OS Server should move to 5.0.8 or later; most listed gateway, cloud-key, and NVR families should move to 5.1.12 or later. Some NAS and Express models have separate minimums in the advisory [1].
- Restrict management access. The admin interface should not be broadly reachable from the internet. Prefer VPN, a management VLAN, or a small trusted source range.
- Review accounts and configuration changes. After patching, look for unknown admins, new API tokens, unexpected VPN or port-forwarding rules, changed firewall policies, and unfamiliar backups.
- Check client systems if compromise indicators exist. If a network incident also involved suspicious downloads, unknown scripts, or odd outbound connections from Windows PCs, scan endpoints with Gridinsoft Anti-Malware and verify suspicious domains or files with Gridinsoft Online Virus Scanner.
The useful distinction is between patching the appliance and trusting the network again. A patched UniFi device closes the known bugs, but a quick configuration review helps catch changes that may have been made before the update. Related Gridinsoft background on network-device risk includes our older Ubiquiti G4 vulnerability note and broader coverage of IoT cyber attacks.
FAQ
Are these UniFi OS vulnerabilities exploited?
Ubiquiti’s bulletin does not state that the flaws are being exploited in the wild. Because three issues are CVSS 10.0 and network-reachable without authentication, admins should still treat the update as urgent.
Is updating the Network Application enough?
No. The advisory is about UniFi OS on devices and servers. Check the UniFi OS version for each appliance, not only the version of a single UniFi application.
Should I factory-reset my UniFi device?
Usually no. Patch first, restrict management access, then review admins, tokens, VPN settings, firewall rules, and recent configuration changes. Reset only when you find strong signs that the device was already compromised.
References
- Ubiquiti Community, Security Advisory Bulletin 064, published May 21 and updated May 22, 2026. Advisory
- Ubiquiti Community, UniFi OS Server 5.0.8 release notes. Release notes
- Ubiquiti Community, UniFi OS Cloud Gateways 5.1.12 release notes. Release notes
