UniFi OS Server Unauthenticated RCE Chain Analysis

Ubiquiti has released Security Advisory Bulletin 064 (SAB-064) addressing a critical vulnerability chain in UniFi OS Server that allows unauthenticated remote code execution (RCE). The attack involves bypassing the Nginx-based authentication gateway (CVE-2026-34908/34909) and exploiting an improper input validation flaw in the package-update service (CVE-2026-34910). This yields an initial foothold that is easily escalated to root due to over-privileged sudoers configurations.

Technical analysis confirms that an attacker can gain full root access via a single network request. This allows for the exfiltration of sensitive material including JWT signing keys, TLS private keys, user databases, and physical security data such as biometric templates and NFC card information. Because the appliance serves as the management plane, compromise extends beyond the host to managed network devices, cameras, and physical door access systems.

This threat is particularly severe because the RCE provides access to the JWT signing key, allowing attackers to forge persistent administrative sessions that remain valid even after the software is patched. Organizations must not only update to UniFi OS 5.0.8 or later but also perform a mandatory rotation of all secrets and signing keys to ensure complete remediation.