TLDR Tech / InfoSec
Critical UniFi OS Auth Bypass Flaws Lead to Unauthenticated Root RCE
Ubiquiti's SAB-064 patch addresses three critical CVSS 10.0 UniFi OS Server vulnerabilities (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910). Bishop Fox demonstrated unauthenticated root Remote Code Execution (RCE) on version 5.0.6 by chaining an Nginx auth-gateway bypass (due to raw vs. normalized URI handling of %2f) with a command injection in the package-update service. While the patch addresses the RCE, it doesn't change JWT verification, meaning stolen signing keys can still forge valid owner-scope tokens against patched 5.0.8 consoles. Therefore, administrators must update their systems (5.1.12 for most Cloud Gateways, 5.1.10 for UNAS, 5.1.11 for Dream Machine Beast, and 4.0.14 for UniFi Express), rebuild any exposed instances, restrict TCP port 11443 to a management VLAN, and rotate JWT, TLS, RADIUS, and database credentials.
Read the full story