Critical Analysis: CVE-2026-34909 - Ubiquiti UniFi OS Path Traversal Vulnerability... — June 24, 2026

Published 24 Jun 2026 · vulnerability management, CVE analysis, threat intelligence, security operations, cybersecurity news

AGMP Partners Initial Discovery and Context Ubiquiti’s UniFi OS, the underlying platform powering a vast array of their network devices from gateways like the Dream Machine (UDM/UDM-Pro) to Cloud Keys and NVRs, just got hit with a critical path traversal vulnerability, CVE-2026-34909, published today, June 24, 2026. This isn't just another arbitrary file read; the implications for network integrity and data confidentiality within enterprise and SMB environments running UniFi OS are significant. This vulnerability affects UniFi OS versions 3.x and earlier across all supported hardware platforms, specifically impacting services exposed through the web-based management interface. This includes UDM, UDM-Pro, UDM-SE, Cloud Key Gen2, Cloud Key Gen2 Plus, and UniFi Protect NVR. We’ve seen a steady increase in adversaries targeting network infrastructure devices due to their high-privilege acces