CVE-2026-34908 — Ubiquiti UniFi OS Improper Access Control Exploitation

let UniFiIPs = dynamic([]);
let SuspiciousEndpoints = dynamic(["/api/", "/proxy/network/api/", "/api/s/default/", "/api/login", "/api/self"]);
CommonSecurityLog
| where TimeGenerated >= ago(24h)
| where DeviceVendor has_any ("Ubiquiti", "UniFi") or DestinationHostName has_any ("unifi", "ubiquiti")
| where RequestURL has_any (SuspiciousEndpoints)
| where (RequestMethod in ("GET", "POST", "PUT", "DELETE") and (isnotempty(SourceIP)))
| extend IsAdminEndpoint = RequestURL has_any ("/api/s/default/cmd/", "/proxy/network/api/s/default/cmd/", "/api/system")
| extend IsUnauthenticated = ResponseCode in ("200", "201", "204") and (isempty(AdditionalExtensions) or AdditionalExtensions !has "authenticated")
| where IsAdminEndpoint == true
| summarize
    RequestCount = count(),
    DistinctEndpoints = dcount(RequestURL),
    Endpoints = make_set(RequestURL, 20),
    ResponseCodes = make_set(ResponseCode, 10),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationHostName
| where RequestCount >= 3 or DistinctEndpoints >= 2
| extend RiskScore = case(
    RequestCount >= 20, "High",
    RequestCount >= 5, "Medium",
    "Low")
| project FirstSeen, LastSeen, SourceIP, DestinationIP, DestinationHostName, RequestCount, DistinctEndpoints, Endpoints, ResponseCodes, RiskScore
| order by RequestCount desc

index=network OR index=proxy OR index=firewall sourcetype=palo_alto_traffic OR sourcetype=cisco_asa OR sourcetype=squid OR sourcetype=bluecoat
| where (dest_host IN ("*unifi*", "*ubiquiti*") OR dest_ip IN (<<UNIFI_IP_LIST>>))
| where uri_path IN ("/api/", "/proxy/network/api/", "/api/s/default/", "/api/s/default/cmd/", "/api/system", "/api/login", "/api/self", "/proxy/network/api/s/default/cmd/")
| eval is_admin_endpoint=if(match(uri_path, "/cmd/|/system|/admin"), 1, 0)
| eval is_success=if(status IN ("200", "201", "204"), 1, 0)
| where is_admin_endpoint=1 AND is_success=1
| stats
    count AS request_count,
    dc(uri_path) AS distinct_endpoints,
    values(uri_path) AS endpoints,
    values(status) AS response_codes,
    min(_time) AS first_seen,
    max(_time) AS last_seen
    BY src_ip, dest_ip, dest_host
| where request_count >= 3
| eval risk_score=case(request_count >= 20, "High", request_count >= 5, "Medium", true(), "Low")
| eval cve="CVE-2026-34908"
| table first_seen, last_seen, src_ip, dest_ip, dest_host, request_count, distinct_endpoints, endpoints, response_codes, risk_score, cve
| sort - request_count

sequence by source.ip with maxspan=10m
  [network where event.category == "network" and
   (destination.domain like~ "*unifi*" or destination.domain like~ "*ubiquiti*") and
   url.path like~ "/api/*" and
   http.response.status_code in (200, 201, 204) and
   http.request.method in ("GET", "POST", "PUT", "DELETE")]
  [network where event.category == "network" and
   (destination.domain like~ "*unifi*" or destination.domain like~ "*ubiquiti*") and
   (url.path like~ "/api/s/default/cmd/*" or url.path like~ "/proxy/network/api/s/default/cmd/*" or url.path like~ "/api/system*") and
   http.response.status_code in (200, 201, 204)]

SELECT
  sourceip,
  destinationip,
  destinationhostname,
  URL,
  "HTTP Status Code" AS http_status,
  "HTTP Method" AS http_method,
  COUNT(*) AS event_count,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Palo Alto PA Series', 'Cisco ASA', 'Juniper SRX', 'Fortinet FortiGate', 'Squid')
  AND (
    destinationhostname ILIKE '%unifi%'
    OR destinationhostname ILIKE '%ubiquiti%'
  )
  AND (
    URL ILIKE '/api/%'
    OR URL ILIKE '/proxy/network/api/%'
  )
  AND (
    URL ILIKE '%/cmd/%'
    OR URL ILIKE '%/system%'
    OR URL ILIKE '%/admin%'
  )
  AND "HTTP Status Code" IN ('200', '201', '204')
  AND starttime >= NOW() - 1 DAYS
GROUP BY sourceip, destinationip, destinationhostname, URL, "HTTP Status Code", "HTTP Method"
HAVING COUNT(*) >= 2
ORDER BY event_count DESC
LIMIT 500

_sourceCategory=network/firewall OR _sourceCategory=network/proxy OR _sourceCategory=network/web
| where (%"dest_host" matches "*unifi*" or %"dest_host" matches "*ubiquiti*")
| where (%"uri" matches "/api/*" or %"uri" matches "/proxy/network/api/*")
| where (%"uri" matches "*/cmd/*" or %"uri" matches "*/system*" or %"uri" matches "*/admin*")
| where %"status" in ("200", "201", "204")
| timeslice 1h
| stats
    count as request_count,
    countDistinct(%"uri") as distinct_endpoints,
    values(%"uri") as endpoints,
    first(%"_messagetime") as first_seen,
    last(%"_messagetime") as last_seen
    by %"src_ip", %"dest_host", _timeslice
| where request_count >= 3
| sort by request_count desc

rule cve_2026_34908_unifi_access_control_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2026-34908 - Ubiquiti UniFi OS Improper Access Control"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-34908"
    cve = "CVE-2026-34908"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.response_code = 200 or
    $e.network.http.response_code = 201 or
    $e.network.http.response_code = 204
    (
      re.regex($e.network.http.request_url, `/api/s/default/cmd/`) or
      re.regex($e.network.http.request_url, `/proxy/network/api/s/default/cmd/`) or
      re.regex($e.network.http.request_url, `/api/system`) or
      re.regex($e.network.http.request_url, `/api/admin`)
    )
    (
      re.regex($e.principal.hostname, `(?i)unifi`) or
      re.regex($e.target.hostname, `(?i)unifi`) or
      re.regex($e.target.hostname, `(?i)ubiquiti`)
    )
    $e.principal.ip = $src_ip
    $e.target.ip = $dst_ip

  match:
    $src_ip, $dst_ip over 10m

  outcome:
    $risk_score = max(
      if($e.network.http.response_code = 200, 50, 0) +
      if(re.regex($e.network.http.request_url, `/cmd/`), 50, 0)
    )
    $event_count = count_distinct($e.metadata.id)
    $endpoints = array_distinct($e.network.http.request_url)

  condition:
    #e >= 2
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkReceiveAcceptIP4
| $TargetPort in (443, 8443, 80, 8080)
| $RemoteAddressIP4 != "127.0.0.1"
| $LocalAddressIP4 != "127.0.0.1"
| groupby([aid, ComputerName, UserName, RemoteAddressIP4, LocalAddressIP4], function=[count(aid, as=ConnectionCount), min(timestamp, as=FirstSeen), max(timestamp, as=LastSeen)])
| $ConnectionCount >= 3
| join(type=inner, field=ComputerName,
    [#event_simpleName=ProcessRollup2
     | $ImageFileName matches "*unifi*"
     | groupby([ComputerName, UserName, ImageFileName, CommandLine], function=count(aid))
    ]
  )
| eval CVE = "CVE-2026-34908"
| eval Vendor = "Ubiquiti"
| eval Product = "UniFi OS"
| sort(ConnectionCount, order=desc, limit=200)
| select([FirstSeen, LastSeen, ComputerName, UserName, RemoteAddressIP4, LocalAddressIP4, ConnectionCount, ImageFileName, CommandLine, CVE, Vendor, Product])