ZDI 2026-02-25

ZDI-26-128: (Pwn2Own) Ubiquiti Networks AI Pro Uncaught Exception Denial-of-Service Vulnerability

CVE-2026-21634

Machine-generated analysis · WAYSCloud LLM

Network-adjacent attackers can trigger denial-of-service without authentication. The vulnerability was demonstrated during Pwn2Own 2026.

Context

The vulnerability affects Ubiquiti Networks AI Pro devices. The source describes an uncaught exception leading to denial-of-service. The vulnerability was exploited during Pwn2Own 2026, indicating public demonstration of the issue.

Operator considerations

Check: Inventory Ubiquiti Networks AI Pro installations for potential exposure.
Isolate: Consider network segmentation for Ubiquiti AI Pro devices given network-adjacent attack vector.
Log: Monitor for denial-of-service events on Ubiquiti AI Pro devices.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Ubiquiti Networks AI Pro. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-21634.

Read the full advisory on ZDI →