Security Advisory Bulletin 064 describing a critical chain of vulnerabilities in UniFi OS Server that allows unauthenticated remote code execution and full root takeover.
The issue combines an authentication-gateway bypass, a path-traversal mismatch, and a command-injection sink in the package-update service.
When chained, these flaws let an attacker send a single crafted HTTP request to the admin interface and turn it into a reverse shell running as root, without any credentials.
UniFi OS Server exposes many management services behind an Nginx front end that terminates TLS and proxies requests to internal backends. The proxy uses two different views of the requested URI: Nginx’s normalized $uri to choose the backend and the raw x-original-uri to decide whether a request is public.
In vulnerable builds this mismatch lets a request that appears to be a public auth-exempt path in its raw, percent-encoded form be routed, after normalization, to an internal authenticated endpoint.
That bypass (CVE-2026-34908 and CVE-2026-34909) gives unauthenticated access to backends that should require credentials.
One such backend is the package-update endpoint. It accepts a package name and, in some code paths, shells out to run a local helper program using a string built with the caller-supplied package name.
According to Ubiquiti, affected releases the package name is not validated or sanitized and the command is executed through a shell, producing a classic command-injection vulnerability (CVE-2026-34910 and the related authenticated CVE-2026-33000).
Reaching that sink without a token becomes possible when the authentication gateway is bypassed as described above.
The injected command initially runs as a service user, not root, but that account has overly broad passwordless sudo rights for utilities like dpkg and systemctl.
An attacker can leverage sudo dpkg to install a malicious package whose maintainer scripts execute as root, or use other allowed sudo paths to escalate directly.
Bishop Fox reproduced the full chain on UniFi OS Server 5.0.6, delivered a reverse shell, and confirmed that the patched 5.0.8 build blocks the attack.
The practical impact is severe because UniFi OS Server is the management plane for networks and, where deployed, physical security systems.
Root on the console lets an attacker read all stored secrets including JWT signing keys, TLS private keys, cloud tokens, user databases, RADIUS and Wi‑Fi credentials, and biometric data. With the signing key an attacker can forge long-lived admin sessions that still work after patching.
From an administrative position the attacker can reconfigure devices, push firewall changes, enroll or clone door credentials, view or delete camera recordings, pivot to cloud-linked sites, or simply destroy configuration and backups.
Immediate defensive steps are clear. Patch UniFi OS Server to 5.0.8 or the appropriate fixed version for your device model. Where you cannot patch immediately, block external access to the UniFi admin interface (commonly TCP 11443) and restrict it to a management network.
Assume any instance reachable before patching is compromised: rotate all secrets starting with the JWT signing key, force logout of sessions, and consider rebuilding systems that were exposed rather than relying on in-place remediation.
Bishop Fox and others have published a safe detection tool that probes for the bypass without executing commands; run it against any reachable UniFi OS Server to determine exposure.
Ubiquiti’s fixes in 5.0.8 address the URI normalization mismatch in Nginx, add strict package-name validation and remove shell execution from the update path, and reduce sudo privileges for the update service.
Those changes close the chain but do not undo prior compromises, so patching must be followed by secret rotation and full incident response where exposure is suspected.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…