{"metadata": {"vulnerability": "CVE-2026-34909", "count": 55, "kinds": {"milestone": 5, "sighting": 25, "kev": 11, "other": 14}, "linked_omitted": 0}, "data": [{"timestamp": "2026-03-31T15:00:06.521Z", "date_only": false, "value": "2026-03-31T15:00:06.521Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-34909", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-05-21T22:00:00Z", "date_only": false, "value": "2026-05-21T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1639", "record": "WID-SEC-W-2026-1639", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-05-21T22:00:00Z", "date_only": false, "value": "2026-05-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1639", "record": "WID-SEC-W-2026-1639", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-05-21T22:00:00Z", "date_only": false, "value": "2026-05-21T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1639", "record": "WID-SEC-W-2026-1639", "field": "vulnerabilities.2.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-21T22:00:00Z", "date_only": false, "value": "2026-05-21T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1639", "record": "WID-SEC-W-2026-1639", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-05-22T00:43:49.072Z", "date_only": false, "value": "2026-05-22T00:43:49.072Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-34909", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-22T02:16:34Z", "date_only": false, "value": "2026-05-22T02:16:34Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-95FP-244G-G3VR", "record": "GHSA-95FP-244G-G3VR", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-05-22T02:16:34.390Z", "date_only": false, "value": "2026-05-22T02:16:34.390", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-34909", "record": "FKIE_CVE-2026-34909", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-05-22T03:30:25Z", "date_only": false, "value": "2026-05-22T03:30:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-95FP-244G-G3VR", "record": "GHSA-95FP-244G-G3VR", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-05-22T07:30:27.944Z", "date_only": false, "value": "2026-05-22T07:30:27.944130Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116617053903196416", "record": "cve-2026-34909", "field": "creation_timestamp", "uuid": "00f67abd-e059-4433-aa5c-aca19a47b774", "content": "\ud83d\udd12 CRITICAL: CVE-2026-34909 - Path Traversal in Ubiquiti UniFi OS Server (CVSS 10). Allows arbitrary file access & manipulation. No patch yet \u2014 restrict access & monitor! Details: https://radar.offseq.com/threat/cve-2026-34909-cwe-22-path-traversal-in-ubiquiti-i-4d93b8c5 #OffSeq #UniFi #Vuln #BlueTeam", "url": "https://infosec.exchange/users/offseq/statuses/116617053903196416"}, {"timestamp": "2026-05-22T07:30:29.565Z", "date_only": false, "value": "2026-05-22T07:30:29.565922Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mmgg2g4mix26", "record": "cve-2026-34909", "field": "creation_timestamp", "uuid": "6d4dae7a-883e-4b62-9541-65ca6703adfb", "content": "\u26a0\ufe0f Ubiquiti UniFi OS Server hit by critical Path Traversal flaw (CVSS 10). No patch yet \u2014 restrict access, monitor for threats. Full system compromise possible. https://radar.offseq.com/threat/cve-2026-34909-cwe-22-path-traversal-in-ubiquiti-i-4d93b8c5 #OffSeq #UniFi #SecurityAlert", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mmgg2g4mix26"}, {"timestamp": "2026-05-22T08:55:33.995Z", "date_only": false, "value": "2026-05-22T08:55:33.995+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1639", "record": "WID-SEC-W-2026-1639", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-05-22T20:19:51.649Z", "date_only": false, "value": "2026-05-22T20:19:51.649Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / hackerone", "record": "CVE-2026-34909", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-26T09:13:20Z", "date_only": false, "value": "2026-05-26T09:13:20.000000Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-ubiquiti-has-addressed-multiple-critical-vulnerabilities-unifi-os-patch", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "28ae5e00-67bb-4f53-99e1-06a89f6569d6", "url": "https://ccb.belgium.be/advisories/warning-ubiquiti-has-addressed-multiple-critical-vulnerabilities-unifi-os-patch"}, {"timestamp": "2026-05-26T16:30:06Z", "date_only": false, "value": "2026-05-26T16:30:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8245", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "0a269d56-6c8e-4a88-97a0-e7d6f9026245", "content": "Ubiquiti \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0442\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0432 UniFi OS, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\nUniFi OS - \u044d\u0442\u043e \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u041e\u0421, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0441\u043e\u043b\u044f\u0445 UniFi \u0438 \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0418\u0422-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0441\u0435\u0442\u0438, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 UniFi, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a UniFi Network, UniFi Protect, UniFi Access, UniFi Talk \u0438 UniFi Connect.\n\n\u041f\u0435\u0440\u0432\u0430\u044f CVE-2026-34908 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u043d\u043e\u0441\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 UniFi OS.\u0451\n\n\u0412\u0442\u043e\u0440\u0430\u044f (CVE-2026-34909) \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u0431\u0430\u0437\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438 (Path Traversal), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438.\n\n\u0422\u0440\u0435\u0442\u044c\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 (CVE-2026-34910) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, Ubiquiti \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0432\u0442\u043e\u0440\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 (CVE-2026-33000) \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0432\u0430\u0436\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (CVE-2026-34911), \u043e\u0431\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043d\u0430 \u0431\u0430\u0437\u0435 Unifi OS.\n\n\u041f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a \u043f\u043e\u043a\u0430 \u043d\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442, \u0431\u044b\u043b\u0438 \u043b\u0438 \u043a\u0430\u043a\u0438\u0435-\u043b\u0438\u0431\u043e \u0438\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043e \u0438\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u043d\u043e \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u044b \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0438\u0437\u043a\u043e\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043e\u043a HackerOne.\n\n\u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 Censys \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0447\u0442\u0438 100 000 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0445 \u043a \u0441\u0435\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 UniFi OS, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 (\u043f\u043e\u0447\u0442\u0438 50 000 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432) \u0440\u0430\u0441\u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442\u0441\u044f \u0432 \u0421\u0428\u0410.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435\u0442 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0442\u043e\u043c, \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u0437 \u043d\u0438\u0445 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043e\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u0447\u0442\u043e \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0433\u043e\u0434\u044b \u0440\u0435\u0448\u0435\u043d\u0438\u044f Ubiquiti \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0438\u0441\u044c \u043c\u0438\u0448\u0435\u043d\u044f\u043c\u0438 \u043a\u0430\u043a APT-\u0433\u0440\u0443\u043f\u043f, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0438\u0445 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432, \u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432.", "url": "https://t.me/true_secator/8245"}, {"timestamp": "2026-05-27T06:38:42Z", "date_only": false, "value": "2026-05-27T06:38:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/ubiquiti-rilevate-nuove-vulnerabilita-1", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "bd4d8905-b066-4368-b3c9-82d7cb5b0c2e", "url": "https://www.acn.gov.it/portale/w/ubiquiti-rilevate-nuove-vulnerabilita-1"}, {"timestamp": "2026-06-09T07:29:00Z", "date_only": false, "value": "2026-06-09T07:29:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2026-34909", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "de3af882-4d92-4a98-a92c-c025d4818825", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-09T07:29:00Z", "date_only": false, "value": "2026-06-09T07:29:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2026-34909", "field": "evidence.0.details.added_date", "uuid": "de3af882-4d92-4a98-a92c-c025d4818825", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-09T07:29:00Z", "date_only": false, "value": "2026-06-09T07:29:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2026-34909", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "de3af882-4d92-4a98-a92c-c025d4818825", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-09T07:29:00Z", "date_only": false, "value": "2026-06-09T07:29:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2026-34909", "field": "status.status_updated_at", "uuid": "de3af882-4d92-4a98-a92c-c025d4818825", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-09T11:45:21.061Z", "date_only": false, "value": "2026-06-09T11:45:21.061604Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/jbhall56/statuses/116719977777948801", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "c09dd812-fa61-4898-ba8b-93a8e3adef35", "content": "The security issues are tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. They have been addressed in May and impact UniFi OS Server versions 5.0.6 and earlier. https://www.bleepingcomputer.com/news/security/critical-unifi-os-bug-lets-hackers-gain-root-without-authentication/", "url": "https://infosec.exchange/users/jbhall56/statuses/116719977777948801"}, {"timestamp": "2026-06-09T11:45:54.834Z", "date_only": false, "value": "2026-06-09T11:45:54.834623Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jbhall56.bsky.social/post/3mnu4pot3nk2c", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "b09ea98a-babf-437c-a519-5e3f8d2fcee4", "content": "The security issues are tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. They have been addressed in May and impact UniFi OS Server versions 5.0.6 and earlier. www.bleepingcomputer.com/news/securit...", "url": "https://bsky.app/profile/jbhall56.bsky.social/post/3mnu4pot3nk2c"}, {"timestamp": "2026-06-19T12:45:07.737Z", "date_only": false, "value": "2026-06-19T12:45:07.737361Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ba2de44b-a107-41a8-8b70-492e99f4ec6f", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "4fbdcd6c-0358-4e59-8cb2-739a6a2f1bec", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ba2de44b-a107-41a8-8b70-492e99f4ec6f", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T00:00:00Z", "date_only": false, "value": "2026-06-23T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-34909", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "ae12d4e6-8e25-4665-9581-2d437ce5b644", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T00:00:00Z", "date_only": true, "value": "2026-06-23", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-34909", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-06-23T00:00:00Z", "date_only": true, "value": "2026-06-23", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-34909", "field": "evidence.0.details.date_added", "uuid": "ae12d4e6-8e25-4665-9581-2d437ce5b644", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T00:00:00Z", "date_only": false, "value": "2026-06-23T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-34909", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "ae12d4e6-8e25-4665-9581-2d437ce5b644", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T00:00:00Z", "date_only": false, "value": "2026-06-23T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-34909", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-06-23T00:00:00Z", "date_only": false, "value": "2026-06-23T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-34909", "record": "FKIE_CVE-2026-34909", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-06-23T00:00:00Z", "date_only": false, "value": "2026-06-23T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-34909", "field": "status.status_updated_at", "uuid": "ae12d4e6-8e25-4665-9581-2d437ce5b644", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T00:00:00Z", "date_only": false, "value": "2026-06-23T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-34909", "field": "containers.adp.0.timeline.0.time", "text": "CVE-2026-34909 added to CISA KEV"}, {"timestamp": "2026-06-23T12:08:44.510Z", "date_only": false, "value": "2026-06-23T12:08:44.510243Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3moxejgzkg22n", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "169fe41d-d223-42fd-8f2a-1ed16da6080c", "content": "Ubiquiti\u88fd\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u6a5f\u5668\u306e\u300cUniFi OS\u300d\u306b\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\u8106\u5f31\u6027\n\nUbiquiti\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u6a5f\u5668\u306b\u642d\u8f09\u3055\u308c\u3066\u3044\u308b\u300cUniFi OS\u300d\u306b\u8907\u6570\u306e\u8106\u5f31\u6027\u304c\u5224\u660e\u3057\u305f\u3002\u6df1\u523b\u306a\u8106\u5f31\u6027\u3082\u8907\u6570\u542b\u307e\u308c\u308b\u3002\n\n...\n\n\u300cCVE-2026-34908\u300d\u306f\u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u4e0d\u5099\u306e\u8106\u5f31\u6027\u3002\u30ea\u30e2\u30fc\u30c8\u3088\u308a\u8a8d\u8a3c\u3092\u5fc5\u8981\u3068\u3059\u308b\u3053\u3068\u306a\u304f\u30b7\u30b9\u30c6\u30e0\u306e\u8a2d\u5b9a\u3092\u5909\u66f4\u3067\u304d\u308b\u3002\n\n\u3055\u3089\u306b\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u306e\u8106\u5f31\u6027\u300cCVE-2026-34909\u300d\u3084\u3001\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u300cCVE-2026-34910\u300d\u306a\u3069\u3082\u78ba\u8a8d\u3055\u308c\u305f\u3002", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3moxejgzkg22n"}, {"timestamp": "2026-06-23T13:14:02Z", "date_only": false, "value": "2026-06-23T13:14:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/ubiquiti-security-advisory-av26-498", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "e2c4c5d4-643d-49be-ab58-850dbe136681", "url": "https://cyber.gc.ca/en/alerts-advisories/ubiquiti-security-advisory-av26-498"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2026-34909", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "de3af882-4d92-4a98-a92c-c025d4818825", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:02:58.876Z", "date_only": false, "value": "2026-06-23T14:02:58.876169Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/de3af882-4d92-4a98-a92c-c025d4818825", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "03ebf660-2656-4a22-90c1-16b8b499faa3", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/de3af882-4d92-4a98-a92c-c025d4818825", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T18:00:02.510Z", "date_only": false, "value": "2026-06-23T18:00:02.510704Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ae12d4e6-8e25-4665-9581-2d437ce5b644", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "3ce3b00f-6b6b-4804-b078-44dcf855c4d2", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ae12d4e6-8e25-4665-9581-2d437ce5b644", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T18:11:12.920Z", "date_only": false, "value": "2026-06-23T18:11:12.920736Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3moxyrlwezv2m", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "69f3d3d4-bcfb-4982-bc4c-615541c205fe", "content": "\ud83d\uded1 CVE-2026-34909\nUbiquiti UniFi OS\nCVSS 10.0 / EPSS 1% / KEV: No\nTL;DR: A malicious actor with access to the network could exploit a Path Traversal vulnerabilit\u2026\nhttps://cvesentinel.com/report/CVE-2026-34909?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3moxyrlwezv2m"}, {"timestamp": "2026-06-23T18:31:31Z", "date_only": false, "value": "2026-06-23T18:31:31Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-95FP-244G-G3VR", "record": "GHSA-95FP-244G-G3VR", "field": "modified", "linked_record": true}, {"timestamp": "2026-06-23T18:43:01.422Z", "date_only": false, "value": "2026-06-23T18:43:01.422610Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/6817245", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "7331b005-6192-41ad-ab4e-6976e3d5d208", "content": "2026-06-23: [CVE-2026-34909] Ubiquiti UniFi OS Path Traversal VulnerabilityUbiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.\ncisakev", "url": "https://feedsin.space/feed/CISAKevBot/items/6817245"}, {"timestamp": "2026-06-23T19:03:54.878Z", "date_only": false, "value": "2026-06-23T19:03:54.878391Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/116800974631729730", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "f2b607c5-c715-4663-a5c0-2b1d8217c417", "content": "CISA has updated the KEV catalogue:\n-  CVE-2026-34908: Ubiquiti UniFi OS Improper Access Control Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34908\n-  CVE-2026-34909: Ubiquiti UniFi OS Path Traversal Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34909\n-  CVE-2026-34910: Ubiquiti UniFi OS Improper Input Validation Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34910\n-  CVE-2025-67038: Lantronix EDS5000 Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-67038 #CISA #infosec #vulnerability", "url": "https://infosec.exchange/users/AAKL/statuses/116800974631729730"}, {"timestamp": "2026-06-24T03:56:19.760Z", "date_only": false, "value": "2026-06-24T03:56:19.760Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-34909", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-24T03:56:19.760Z", "date_only": false, "value": "2026-06-24T03:56:19.760Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-34909", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-26T00:00:00Z", "date_only": true, "value": "2026-06-26", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-34909", "field": "evidence.0.details.due_date", "uuid": "ae12d4e6-8e25-4665-9581-2d437ce5b644", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-01T02:45:12.022Z", "date_only": false, "value": "2026-07-01T02:45:12.022450Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-028", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "3f3eb9be-ae9e-4829-8136-3201420fffa4", "url": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-028"}, {"timestamp": "2026-07-04T13:24:46.322Z", "date_only": false, "value": "2026-07-04T13:24:46.322471Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mpt5vdshuc2m", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "57987558-98f1-4f25-8b00-9a3b4f812ae0", "content": "UniFi OS\u306e\u91cd\u5927\u306a\u30d0\u30b0\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u30cf\u30c3\u30ab\u30fc\u304c\u30eb\u30fc\u30c8\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u308b\u3002\n\n\u653b\u6483\u8005\u306f\u3001Ubiquiti UniFi OS\u30b5\u30fc\u30d0\u30fc\u306b\u5b58\u5728\u3059\u308b\u65e2\u306b\u4fee\u6b63\u6e08\u307f\u306e3\u3064\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3059\u308b\u3053\u3068\u3067\u3001\u8a8d\u8a3c\u306a\u3057\u3067root\u6a29\u9650\u3067\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b\u3002\n\n\u3053\u308c\u3089\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u306f\u3001CVE-2026-34908\u3001CVE-2026-34909\u3001\u304a\u3088\u3073CVE-2026-34910\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306f5\u6708\u306b\u5bfe\u51e6\u6e08\u307f\u3067\u3001UniFi OS Server\u30d0\u30fc\u30b8\u30e7\u30f35.0.6\u4ee5\u524d\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u306b\u5f71\u97ff\u3057\u307e\u3059\u3002\n\n\u3053\u308c\u30893\u3064\u306e\u8106\u5f31\u6027\u306f\u3044\u305a\u308c\u3082\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u5fc5\u8981\u3068\u3059\u308b\u306b\u3082\u304b\u304b\u308f\u3089\u305a\u3001\u6700\u9ad8\u30ec\u30d9\u30eb\u306e...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mpt5vdshuc2m"}, {"timestamp": "2026-07-06T20:17:48.029Z", "date_only": false, "value": "2026-07-06T20:17:48.029946Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/csirts.bsky.social/post/3mpyvvw2qam2y", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "4a163a33-0840-4c28-8958-7783956abe89", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-34909: Ubiquiti UniFi OS Path Traversal Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-34909", "url": "https://bsky.app/profile/csirts.bsky.social/post/3mpyvvw2qam2y"}, {"timestamp": "2026-07-12T12:00:04.645Z", "date_only": false, "value": "2026-07-12T12:00:04.645804Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/habr_com_news/47181", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "6e520430-131e-4322-b0d4-2913b72d335d", "content": "\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438\u00a0\u043c\u043e\u0433\u043b\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c\u00a0\u0442\u0440\u0438 \u0443\u0436\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Ubiquiti UniFi OS \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0438 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-34908, CVE-2026-34909 \u0438 CVE-2026-34910. \u041e\u043d\u0438 \u0431\u044b\u043b\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043c\u0430\u0435 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 UniFi OS Server 5.0.6 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435.\n\n#\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c #\u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435", "url": "https://t.me/habr_com_news/47181"}, {"timestamp": "2026-07-20T04:34:41.171Z", "date_only": false, "value": "2026-07-20T04:34:41.171332Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mr2hq7rods2z", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "21ad768d-ef80-404b-a2ab-ec16153595e3", "content": "CISA\u3001Ubiquiti UniFi OS\u306e\u6b20\u9665\u3092KEV\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001Ubiquiti UniFi OS\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b3\u3064\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3092\u3001\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\n\u3053\u308c\u306f\u3001\u3053\u306e\u666e\u53ca\u3057\u3066\u3044\u308b\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u7ba1\u7406\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u306b\u4f9d\u5b58\u3059\u308b\u5927\u4f01\u696d\u304a\u3088\u3073\u5c0f\u898f\u6a21\u30aa\u30d5\u30a3\u30b9\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u74b0\u5883\u306e\u4e21\u65b9\u306b\u3068\u3063\u3066\u3001\u30ea\u30b9\u30af\u304c\u5897\u5927\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u6d6e\u304d\u5f6b\u308a\u306b\u3057\u3066\u3044\u308b\u3002\n\n\u65b0\u305f\u306b\u767a\u898b\u3055\u308c\u305f\u8106\u5f31\u6027\u3001CVE-2026-34908\u3001CVE-2026-34909\u3001\u304a\u3088\u3073CVE-2026-34910\u306f\u3001UniFi OS...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mr2hq7rods2z"}, {"timestamp": "2026-07-23T16:10:00.137Z", "date_only": false, "value": "2026-07-23T16:10:00.137", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-34909", "record": "FKIE_CVE-2026-34909", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-08-05T20:09:09.628Z", "date_only": false, "value": "2026-08-05T20:09:09.628842Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3msedfzw4kc2v", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "cf7054ba-5c24-4b7b-a709-a6a54083c27e", "content": "CISA Adds Four Known Exploited Vulnerabilities to Catalog\nRelease Date June 23, 2026\n\nCVE-2025-67038 Lantronix EDS5000 Code Injection Vulnerability\nCVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability\nCVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability\nCVE-2026-34910 U...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3msedfzw4kc2v"}, {"timestamp": "2026-08-05T20:11:49.427Z", "date_only": false, "value": "2026-08-05T20:11:49.427831Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3msedksbfdk2m", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "4e293688-258d-4df3-aad4-f436395a07c0", "content": "CISA Adds Four Known Exploited Vulnerabilities to Catalog\nRelease Date June 23, 2026\n\nCVE-2025-67038 Lantronix EDS5000 Code Injection Vulnerability\nCVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability\nCVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability\nCVE-2026-34910 U...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3msedksbfdk2m"}, {"timestamp": "2026-08-22T19:00:04.500Z", "date_only": false, "value": "2026-08-22T19:00:04.500343Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99203", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "61acd14e-59c9-4bea-abaf-33133ca1e731", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34910-unifi-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-22 11:25:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-34910 - CVE-2026-34909 Unifi OS\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99203", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-23T00:00:07.907Z", "date_only": false, "value": "2026-08-23T00:00:07.907563Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/thebugbountyhunter/10664", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "ea95356b-845f-4970-918f-0ececb6acaff", "content": "Pre-Auth RCE in UniFi OS - CVE-2026-34909: One Request to Root Behind Seven Products ($42,751)\n\nhttps://www.catchify.sa/post/pre-auth-rce-unifi-os-one-request-to-root", "url": "https://t.me/thebugbountyhunter/10664", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-28T13:00:05.133Z", "date_only": false, "value": "2026-08-28T13:00:05.133668Z", "kind": "sighting", "label": "Seen", "source": "Telegram/CfRvWZv5RrUF8689qv7kg16a3mW0159b7rTcNr-wYLT-sQY", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "96d2002c-6e24-474b-b147-202a2a5a0975"}, {"timestamp": "2026-11-04T13:00:01Z", "date_only": false, "value": "2026-11-04T13:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-34909", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "ae12d4e6-8e25-4665-9581-2d437ce5b644", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-14T11:21:14.136Z", "anchors": {"origin": {"timestamp": "2026-05-21T22:00:00Z", "date_only": false, "value": "2026-05-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1639", "record": "WID-SEC-W-2026-1639", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-05-21T22:00:00Z", "date_only": false, "value": "2026-05-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1639", "record": "WID-SEC-W-2026-1639", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": {"timestamp": "2026-08-22T19:00:04.500Z", "date_only": false, "value": "2026-08-22T19:00:04.500343Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99203", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "61acd14e-59c9-4bea-abaf-33133ca1e731", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34910-unifi-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-22 11:25:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-34910 - CVE-2026-34909 Unifi OS\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99203", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-06-09T07:29:00Z", "date_only": false, "value": "2026-06-09T07:29:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2026-34909", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "de3af882-4d92-4a98-a92c-c025d4818825", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 1589340.0, "hours": 441.48333333333335, "days": 18.395138888888887, "min_seconds": 1589340.0, "max_seconds": 1589340.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-21T22:00:00Z", "date_only": false, "value": "2026-05-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1639", "record": "WID-SEC-W-2026-1639", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-06-09T07:29:00Z", "date_only": false, "value": "2026-06-09T07:29:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2026-34909", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "de3af882-4d92-4a98-a92c-c025d4818825", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 1589340.0, "hours": 441.48333333333335, "days": 18.395138888888887, "min_seconds": 1589340.0, "max_seconds": 1589340.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-21T22:00:00Z", "date_only": false, "value": "2026-05-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1639", "record": "WID-SEC-W-2026-1639", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-06-09T07:29:00Z", "date_only": false, "value": "2026-06-09T07:29:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2026-34909", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "de3af882-4d92-4a98-a92c-c025d4818825", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 8024404.5, "hours": 2229.00125, "days": 92.87505208333333, "min_seconds": 8024404.5, "max_seconds": 8024404.5, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-21T22:00:00Z", "date_only": false, "value": "2026-05-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1639", "record": "WID-SEC-W-2026-1639", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-08-22T19:00:04.500Z", "date_only": false, "value": "2026-08-22T19:00:04.500343Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99203", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "61acd14e-59c9-4bea-abaf-33133ca1e731", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34910-unifi-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-22 11:25:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-34910 - CVE-2026-34909 Unifi OS\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99203", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 15254474.136492, "hours": 4237.353926803334, "days": 176.55641361680557, "min_seconds": 15254474.136492, "max_seconds": 15254474.136492, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-21T22:00:00Z", "date_only": false, "value": "2026-05-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1639", "record": "WID-SEC-W-2026-1639", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-14T11:21:14.136Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 13665134.136492, "hours": 3795.87059347, "days": 158.1612747279167, "min_seconds": 13665134.136492, "max_seconds": 13665134.136492, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-09T07:29:00Z", "date_only": false, "value": "2026-06-09T07:29:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2026-34909", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "de3af882-4d92-4a98-a92c-c025d4818825", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-14T11:21:14.136Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 7230069.636492, "hours": 2008.3526768033332, "days": 83.68136153347223, "min_seconds": 7230069.636492, "max_seconds": 7230069.636492, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-22T19:00:04.500Z", "date_only": false, "value": "2026-08-22T19:00:04.500343Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99203", "record": "CVE-2026-34909", "field": "creation_timestamp", "uuid": "61acd14e-59c9-4bea-abaf-33133ca1e731", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34910-unifi-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-22 11:25:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-34910 - CVE-2026-34909 Unifi OS\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99203", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T11:21:14.136Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}