CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog

TL;DR

CISA added four actively exploited flaws to its KEV catalog on June 23, 2026. The bugs hit Ubiquiti UniFi OS and Lantronix EDS5000 devices. Federal agencies must patch by June 26, 2026.

Why It Matters

These devices sit deep inside business and industrial networks. Therefore, one weak appliance can open a path to many systems. The CISA KEV catalog only lists flaws with proof of real-world attacks. So inclusion here signals urgent, confirmed risk. Three UniFi OS bugs each score a perfect CVSS 10. Meanwhile, the Lantronix flaw scores 9.8 and hands attackers root access. Ubiquiti gear alone runs on countless small-business and enterprise networks.

How the Attacks Work

Ubiquiti UniFi OS (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910)

A network attacker needs no credentials for these bugs. One flaw allows unauthorized system changes. Another walks the file system through path traversal. The third injects commands through weak input checks. Together, they can hand over full device control.

Lantronix EDS5000 (CVE-2025-67038)

The HTTP server builds a log command from the username. As a result, an attacker can inject OS commands during a failed login. Those commands then run with root privileges.

Affected Versions

The UniFi OS flaws affect Ubiquiti console and gateway devices. The Lantronix issue affects EDS5000 version 2.1.0.0R3.

Patch and Mitigation

Update UniFi OS to version 5.0.8 or later right now. Lantronix users should move to EDS5000 firmware 2.2.0.0R1. Until you patch, restrict management access to trusted networks. Also watch logs for odd requests and new admin changes. A public scanner can already flag vulnerable UniFi OS hosts. These CISA KEV catalog entries carry a June 26 federal deadline, so act fast.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.