Cyber Posture

CVE-2026-34910

Critical

Published: 22 May 2026

Published
22 May 2026
Modified
22 May 2026
KEV Added
Patch
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0010 28.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-34910 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Ui (inferred from references). Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-20

Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.

addresses: CWE-20

Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.

addresses: CWE-20

Directly implements checks on information inputs to reject invalid data before processing.

addresses: CWE-20

Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

Network-accessible improper input validation enabling remote command injection directly maps to public-facing app exploitation (T1190) and arbitrary command execution via shell (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
OWASP Top 10 Web 2025

Affected Products

Ui
inferred from references and description; NVD did not file a CPE for this CVE

CVEs Like This One

CVE-2025-55270Shared CWE-20
CVE-2026-22615Shared CWE-20
CVE-2025-1097Shared CWE-20
CVE-2026-20856Shared CWE-20
CVE-2026-23836Shared CWE-20
CVE-2026-44343Shared CWE-20
CVE-2025-20393Shared CWE-20
CVE-2025-61809Shared CWE-20
CVE-2026-4755Shared CWE-20
CVE-2025-54385Shared CWE-20

EU & UK References

Regulatory context (EU CRA / NIS2 / DORA / UK NIS Regulations)

EU Cyber Resilience Act — coordinated disclosure

Critical and high-severity vulnerabilities in products with digital elements may trigger coordinated-disclosure obligations under the EU Cyber Resilience Act (CRA, Regulation 2024/2847). Manufacturers placing products on the EU market must notify ENISA and the relevant CSIRTs without undue delay once active exploitation is known.

References