CVE-2026-34910: Critical Command Injection in UniFi OS

CVE-2026-34910 is an Improper Input Validation vulnerability that enables Command Injection on UniFi OS devices. A user with network access can exploit it to execute arbitrary commands on the device. UniFi OS devices exposed on internal or internet-facing networks are affected. Severity: CVSS 10.0 (critical).

The vulnerability has the maximum CVSS score of 10.0, confirming critical impact. The official NVD description confirms command injection without input validation limits. Published May 22, 2026 on NVD. Recent social signals indicate this CVE was cited in public lists of relevant vulnerabilities this week, though these signals are not verified.

Immediately verify if you have UniFi OS devices in your environment. If unpatched, they pose critical risk to your network perimeter. Recommendation: apply security patches from the vendor with maximum urgency. If patches are unavailable, isolate devices from public network and restrict internal access to trusted networks only. Monitor access logs for exploitation attempts.