CVE-2026-34910Critical· 10.0▾ Hadal⚠ Exploited in the wildPoC availableA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 55 · likelihood 18 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Jun 26, 2026
Last analysed / modified upstream
46%
46% → 90%
2 GitHub repos · Nuclei ×1 (last check)
Added to the CISA catalog on Jun 23, 2026. Federal remediation due Jun 26, 2026. View catalog ↗
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
unifi_os_server < 5.0.8unifi_cloud_gateway_industrial_firmware < 5.1.12unifi_dream_machine_firmware < 5.1.12unifi_dream_machine_pro_firmware < 5.1.12unifi_dream_machine_special_edition_firmware < 5.1.12unifi_dream_machine_pro_max_firmware < 5.1.12enterprise_fortress_gateway_firmware < 5.1.12unifi_dream_wall_firmware < 5.1.12unifi_dream_router_firmware < 5.1.12unifi_dream_router_7_firmware < 5.1.12unifi_express_7_firmware < 5.1.12unifi_network_video_recorder_firmware < 5.1.12unifi_network_video_recorder_pro_firmware < 5.1.12unifi_network_video_recorder_instant_firmware < 5.1.12enterprise_network_video_recorder_firmware < 5.1.12unifi_cloud_gateway_ultra_firmware < 5.1.12unifi_cloud_gateway_max_firmware < 5.1.12unifi_cloud_gateway_fiber_firmware < 5.1.12unifi_dream_router_5g_max_firmware < 5.1.12enterprise_network_video_recorder_core_firmware < 5.1.12unifi_cloud_key_plus_firmware < 5.1.12unifi_cloudkey_firmware < 5.1.12unifi_cloudkey_enterprise_firmware < 5.1.12unifi_network_video_recorder_g2_firmware < 5.1.12unifi_network_video_recorder_g2_pro_firmware < 5.1.12unifi_dream_machine_beast_firmware < 5.1.11unas_2_firmware < 5.1.10unas_4_firmware < 5.1.10unas_pro_firmware < 5.1.10unas_pro_4_firmware < 5.1.10unas_pro_8_firmware < 5.1.10Upgrade past the affected range:
unifi_os_server 5.0.8unifi_cloud_gateway_industrial_firmware 5.1.12unifi_dream_machine_firmware 5.1.12unifi_dream_machine_pro_firmware 5.1.12unifi_dream_machine_special_edition_firmware 5.1.12unifi_dream_machine_pro_max_firmware 5.1.12enterprise_fortress_gateway_firmware 5.1.12unifi_dream_wall_firmware 5.1.12unifi_dream_router_firmware 5.1.12unifi_dream_router_7_firmware 5.1.12unifi_express_7_firmware 5.1.12unifi_network_video_recorder_firmware 5.1.12unifi_network_video_recorder_pro_firmware 5.1.12unifi_network_video_recorder_instant_firmware 5.1.12enterprise_network_video_recorder_firmware 5.1.12unifi_cloud_gateway_ultra_firmware 5.1.12unifi_cloud_gateway_max_firmware 5.1.12unifi_cloud_gateway_fiber_firmware 5.1.12unifi_dream_router_5g_max_firmware 5.1.12enterprise_network_video_recorder_core_firmware 5.1.12unifi_cloud_key_plus_firmware 5.1.12unifi_cloudkey_firmware 5.1.12unifi_cloudkey_enterprise_firmware 5.1.12unifi_network_video_recorder_g2_firmware 5.1.12unifi_network_video_recorder_g2_pro_firmware 5.1.12unifi_dream_machine_beast_firmware 5.1.11unas_2_firmware 5.1.10unas_4_firmware 5.1.10unas_pro_firmware 5.1.10unas_pro_4_firmware 5.1.10unas_pro_8_firmware 5.1.10Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-30040High· 8.8Windows MSHTML Platform Security Feature Bypass Vulnerability
CVE-2018-19949Critical· 9.8If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands
CVE-2022-29499Critical· 9.8The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation
CVE-2015-2291High· 7.8(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted …
CVE-2019-1068High· 8.8A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
CVE-2021-45105Medium· 5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups