CISA issued a Binding Operational Directive giving federal agencies just three days to patch or mitigate three actively exploited vulnerabilities in Ubiquiti UniFi OS devices. The flaws, added to the Known Exploited Vulnerabilities catalog, are CVE-2026-34908 (access control bypass allowing unauthenticated changes and potential full compromise), CVE-2026-34909 (directory/path traversal exposing sensitive files and credentials), and CVE-2026-34910 (improper input validation enabling OS command injection and remote code execution).
Ubiquiti had released updates for all three in May, and auto-updating systems like those used by Leo Laporte were already protected. The rapid exploitation following disclosure or reverse engineering of patches underscores the need to remove human decision-making from update processes through automation.
While automated updates carry a small risk of issues, such problems have historically been rare and are expected to become even less common as more infrastructure is secured. This directive reflects broader shifts in vulnerability response dynamics, where traditional timelines no longer apply.