CVE-2026-34909 IBM QRadar · QRadar

Detect Ubiquiti UniFi OS Path Traversal Exploitation Attempt in IBM QRadar

Detects exploitation attempts targeting CVE-2026-34909, a path traversal vulnerability (CWE-22) in Ubiquiti UniFi OS. This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to traverse directory boundaries to access sensitive files or execute unauthorized actions on UniFi network management devices.

MITRE ATT&CK

Tactic
Initial Access Defense Evasion Discovery

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  "Event Name",
  COUNT(*) AS attempt_count,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  devicetype IN (SELECT id FROM devicetypes WHERE name ILIKE '%proxy%' OR name ILIKE '%firewall%' OR name ILIKE '%ids%')
  AND destinationport IN (80, 443, 8080, 8443)
  AND (
    URL ILIKE '%../%'
    OR URL ILIKE '%..%2F%'
    OR URL ILIKE '%..%5C%'
    OR URL ILIKE '%2e%2e%2f%'
    OR URL ILIKE '%252f%'
    OR URL ILIKE '%2e%2e/%'
  )
  AND LOGSOURCETIME(starttime) > NOW() - 7 DAYS
GROUP BY sourceip, destinationip, destinationport, URL, username, "Event Name"
ORDER BY attempt_count DESC
LAST 7 DAYS
critical severity medium confidence

QRadar AQL query detecting HTTP path traversal payloads targeting UniFi OS management ports, correlating source and destination for triage.

Data Sources

QRadar proxy log sourcesIDS/IPS log sourcesFirewall log sources

Required Tables

events

False Positives & Tuning

  • Network vulnerability scanners such as Rapid7 or Tenable producing traversal test payloads
  • Authorized red team activities targeting network management infrastructure
  • Misconfigured applications sending double-encoded URLs through the network
  • Log aggregation pipeline artifacts that URL-encode legitimate paths during normalization

Other platforms for CVE-2026-34909

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Basic Path Traversal Probe Against UniFi OS Management Interface

    Expected signal: HTTP request log entry on the UniFi device or upstream proxy showing the traversal sequence in the URL. Network flow record for destination port 8443 from the test source IP.

  2. Test 2URL-Encoded Path Traversal Bypass Attempt

    Expected signal: HTTP request containing URL-encoded traversal sequence `%2e%2e%2f` captured in proxy or IDS logs. Detection should fire on both raw and decoded URL fields.

  3. Test 3Double-Encoded Traversal Sequence for WAF Bypass Simulation

    Expected signal: HTTP request log entry containing `%252f` in the URL, captured by proxy or WAF logs upstream of the UniFi device.

  4. Test 4Automated Path Traversal Scan Using Nuclei

    Expected signal: Multiple rapid HTTP requests to port 8443 containing various traversal payloads in quick succession, consistent with scanner behavior. Source IP generates a burst of traversal-pattern requests within seconds.

Last updated: 2026-06-24 Research depth: standard
References (4)

Unlock Pro Content

Get the full detection package for CVE-2026-34909 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0005Defense EvasionTA0007Discovery

Related Techniques

T1190Exploit Public-Facing ApplicationT1083File and Directory DiscoveryT1552.001Credentials In FilesT1021.004SSH

Same Tactic: Initial Access

Popular Detections