CVE-2026-34911 is a high-severity path traversal issue (CWE-22) affecting UniFi OS devices. The supplied record says a network-accessible attacker with low privileges could reach files on the underlying system and potentially expose sensitive information. The CVSS v3.1 vector indicates no user interaction, low attack complexity, and high confidentiality impact.
CVE-2026-34910 is a Critical vulnerability disclosed on 2026-05-22 affecting UniFi OS devices, where improper input validation could allow a network-accessible command injection. The NVD record rates the issue CVSS 10.0 with no privileges required and no user interaction, making it a high-priority exposure for any environment running the affected platform.
Published on 2026-05-22, CVE-2026-34909 is a critical path traversal vulnerability in UniFi OS devices. A network-accessible attacker could access files on the underlying system and, according to the CVE description, potentially manipulate that access to reach an underlying account. NVD rates the issue CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and maps it to CWE-22.
CVE-2026-34908 is a critical improper access control issue affecting UniFi OS devices. According to the CVE description and NVD metadata, a network-accessible attacker could abuse the flaw to make unauthorized changes to the system. The NVD record lists the issue as remotely exploitable with no privileges or user interaction required, and the impact is rated high across confidentiality, integrity, and availability.
CVE-2026-33000 is a critical improper input validation issue affecting UniFi OS devices. According to the NVD record, a network-accessible attacker with high privileges could trigger command injection, with potential impacts to confidentiality, integrity, and availability. The published CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, which indicates severe consequences despite the high-privilege prerequisite.