Critical RCE Chain Discovered in Ubiquiti UniFi OS Servers Security researchers at Bishop Fox have uncovered a critical exploit chain in Ubiquiti UniFi OS servers, allowing attackers to achieve unauthenticated remote code execution (RCE) with root privileges. The attack leverages three previously patched vulnerabilities CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 which were addressed in May but can be chained to bypass authentication and execute arbitrary commands. The flaws affect UniFi OS Server versions 5.0.6 and earlier, with each vulnerability playing a distinct role in the exploit: - CVE-2026-34908 (Improper Access Control) – Enables unauthorized system modifications. - CVE-2026-34909 (Path Traversal) – Exposes files on the underlying OS. - CVE-2026-34910 (Command Injection) – Allows arbitrary command execution. By combining these vulnerabilities, attackers can bypass authentication via a URI normalization mismatch in UniFi OS’s request handling. Once inside, they exploit a package-update endpoint to inject commands, which execute under a highly privileged service account with passwordless sudo access, making root escalation trivial. Bishop Fox validated the attack on a UniFi OS Server 5.0.6 instance, confirming that no credentials or user interaction are required to gain a root shell. Since UniFi OS servers manage network infrastructure including physical access controls, surveillance, and identity systems compromise grants attackers full administrative control over an organization’s environment. While the researchers did not release a full proof-of-concept (PoC), they provided a detection script to identify vulnerable instances. The tool safely checks for exposure without executing malicious commands, classifying systems as "vulnerable," "patched," "unaffected," or "inconclusive." However, it does not detect past exploitation or backdoors, as the attack leaves no authentication logs. Defenders are advised to upgrade to UniFi OS Server 5.0.8 or later, though organizations should verify the integrity of updated systems to ensure they were not previously compromised. Additional monitoring recommendations include tracking requests to `/api/auth/validate-sso/` and `/ucs/update/latest_package`, as well as suspicious processes under `ucs-update`.