CISA ADDS FOUR ACTIVELY EXPLOITED VULNERABILITIES TO KNOWN EXPLOITED VULNERABILITIES CATALOG

Threat Summary

Category: Vulnerability Alert
Affected Technologies: Lantronix EDS5000, Ubiquiti UniFi OS
Primary Risk: Remote System Compromise, Unauthorized Access, Administrative Control, Network Penetration
Exploitation Status: Active Exploitation Confirmed
Target Environment: Government Networks, Enterprise Infrastructure, Network Management Systems, Internet-Facing Devices
Operational Impact: System Takeover, Unauthorized Administrative Access, Network Exposure, Potential Data Compromise
Threat Surface: Publicly Accessible Management Interfaces and Network Appliances

---

CISA has added four newly identified vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog after determining that the flaws are being actively exploited by threat actors in real-world attacks.

The additions include one vulnerability affecting Lantronix EDS5000 devices and three vulnerabilities affecting Ubiquiti UniFi OS environments.

---

New KEV Additions

CVE-2025-67038
Affected Product: Lantronix EDS5000
Vulnerability Type: Code Injection
Risk: Remote command execution and potential system compromise

CVE-2026-34908
Affected Product: Ubiquiti UniFi OS
Vulnerability Type: Improper Access Control
Risk: Unauthorized access to protected resources and administrative functions

CVE-2026-34909
Affected Product: Ubiquiti UniFi OS
Vulnerability Type: Path Traversal
Risk: Unauthorized access to files, directories, and sensitive system resources

CVE-2026-34910
Affected Product: Ubiquiti UniFi OS
Vulnerability Type: Improper Input Validation
Risk: Manipulation of application processes and potential security bypass conditions

The addition of these vulnerabilities to the KEV Catalog indicates that exploitation activity has been observed and validated. Once vulnerabilities receive KEV designation, organizations should assume threat actors are actively scanning for vulnerable systems and attempting exploitation where opportunities exist.

---

Vulnerability Breakdown

Code Injection vulnerabilities remain among the most dangerous classes of software flaws because they may allow attackers to execute unauthorized commands directly on targeted systems. Successful exploitation can provide attackers with the ability to alter configurations, deploy malware, establish persistence, or gain broader access to connected environments.

Improper Access Control vulnerabilities can allow attackers to bypass intended security restrictions and gain access to administrative functions or protected resources that should remain inaccessible.

Path Traversal vulnerabilities occur when applications improperly validate file path requests, potentially allowing attackers to access files and directories outside intended boundaries.

Improper Input Validation vulnerabilities arise when applications fail to properly verify user-supplied data before processing it, potentially creating conditions for additional exploitation techniques and unauthorized actions.

---

Infrastructure at Risk

• Lantronix EDS5000 deployments
• Ubiquiti UniFi OS environments
• Enterprise network management systems
• Government network infrastructure
• Remote administration platforms
• Internet-facing management interfaces
• Network appliance ecosystems
• Authentication and device management environments
• Cloud-connected infrastructure devices
• Critical administrative access systems

---

Vendor Defense / Reliance

Organizations utilizing affected products should:

• Identify all Lantronix EDS5000 and UniFi OS deployments
• Review vendor security advisories and mitigation guidance
• Apply available updates and patches immediately
• Review authentication and administrative logs
• Investigate indicators of unauthorized access
• Audit privileged accounts and permissions
• Restrict public exposure of management interfaces
• Validate system integrity after remediation
• Increase monitoring of network infrastructure devices
• Review incident response procedures for potential compromise scenarios

---

Forecast — 30 Days

• Increased scanning activity targeting vulnerable Lantronix and UniFi deployments
• Expanded exploitation attempts against internet-facing management interfaces
• Higher remediation activity across government and enterprise networks
• Increased threat hunting focused on network infrastructure assets
• Additional threat actor interest in administrative access platforms
• Potential integration of these vulnerabilities into broader intrusion campaigns

---

TRJ Verdict

The addition of four vulnerabilities to the KEV Catalog is a strong indicator that threat actors are actively targeting network infrastructure and management platforms that often sit at the center of enterprise operations.

The three UniFi OS vulnerabilities and the Lantronix EDS5000 flaw represent more than isolated software defects. They affect systems that frequently maintain elevated privileges, administrative access, and visibility across broader network environments.

Organizations should view these KEV additions as active operational threats rather than routine patch notices. Once vulnerabilities reach the KEV Catalog, the question is no longer whether exploitation is possible. The more important question becomes whether vulnerable systems have already been targeted before remediation takes place.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---