4 new KEV entries: Ubiquiti UniFi OS and what else CISA flagged

On 2026-06-23, CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog: three affecting Ubiquiti UniFi OS and one affecting Lantronix EDS5000 serial device servers. All four carry the standard KEV signal: CISA has evidence of active, in-the-wild exploitation, and federal civilian agencies are on the clock to remediate under Binding Operational Directive 22-01. Everyone else should treat that deadline as the outer limit of acceptable delay, not a target.

This post covers the four new entries, then folds in two KEV additions from earlier in the same week (Splunk Enterprise and a Joomla content editor extension), because the same operational playbook applies to all of them. If you run any of this software, confirm exposure today and prepare a defensible answer before the deadline.

The four additions on 2026-06-23

Ubiquiti UniFi OS: CVE-2026-34910, CVE-2026-34909, CVE-2026-34908. Ubiquiti's UniFi OS underpins its Cloud Keys, Dream Machines, and UniFi Network Video Recorders. CISA's KEV entries describe three distinct defects that chain naturally in a real intrusion:

Together, the three map to the classic post-recon pattern: read what you should not (34909), change what you should not (34908), then execute what you should not (34910). The KEV language says "malicious actor with access to the network," which in practice covers any attacker with a LAN foothold, any device on a flat guest or IoT segment that can reach the controller, and any controller interface that reached a routable path by accident. UniFi controllers are common at the network edge for small offices, retail sites, and MDU installations; management interfaces routinely extend to broader segments than operators intend.

Lantronix EDS5000: CVE-2025-67038. The EDS5000 is a serial-to-Ethernet device server that connects legacy serial peripherals (industrial equipment, building controls, medical devices, point-of-sale hardware) to IP networks. CISA's KEV description states that the code injection is in the username parameter and that injected commands execute with root privileges. That is as bad as embedded-device flaws get: pre-authentication, root-level, on a device class designed specifically to bridge fragile OT hardware to IT networks. EDS5000s are typically deployed exactly where a root RCE causes the most damage: adjacent to gear you cannot easily patch or replace.

The rest of the week: Splunk and a Joomla editor extension

Two earlier KEV additions from the same week belong in the same remediation sprint.

Why CISA added them and how to read the signal

KEV is not a scoring exercise. A CVE lands in KEV when CISA has "reliable evidence" that the vulnerability has been exploited in the wild: a factual claim about attacker behavior, not a prediction. Someone is already doing this. For the four 2026-06-23 entries, confirmed exploitation is the basis for inclusion. The right question for defenders is not "is this severe enough to prioritize" but "have we finished the checks below."

How to tell whether you are affected

The KEV entries are terse; treat vendor advisories as the source of truth for affected version ranges and patched builds. Use asset data you already have. A useful starting point:

# UniFi controllers: find management interfaces on your network
# Adjust CIDRs to your environment; run from a segment that can reach them.
nmap -Pn -p 443,8443,8080,8880,8843 --open \
  --script http-title,ssl-cert 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 \
  -oA unifi_sweep

# Lantronix EDS5000: common management ports
nmap -Pn -p 22,23,80,443,9999,30718 --open -oA eds5000_sweep 10.0.0.0/8

# Splunk Enterprise: web and management
nmap -Pn -p 8000,8089 --open --script http-title -oA splunk_sweep 10.0.0.0/8

# Joomla with the Widget Factory Content Editor: check plugin presence
# Run against each Joomla host you own.
curl -sk "https://example.tld/administrator/manifests/files/" | \
  grep -i -E "widgetfactory|content.?editor"

Pair the network sweep with your CMDB and EDR inventory. A device that answers on a UniFi management port but is not in the CMDB is exactly the kind of asset that gets exploited first.

What to do inside the federal remediation deadline

BOD 22-01 gives federal civilian agencies a fixed remediation window from the KEV addition date. Whether or not you are a federal agency, that window is a defensible external benchmark. Treat it as the outer limit and work backward:

  1. Identify. Confirm presence and version of UniFi OS, EDS5000, Splunk Enterprise, and the Joomla Widget Factory Content Editor across every environment you own, including lab, staging, subsidiaries, and acquisitions.
  2. Contain first, patch second. For UniFi and EDS5000, immediately remove management interfaces from any segment that does not need to reach them. Restrict to a jump host or management VLAN. For the Joomla extension, disable it if you cannot patch same-day.
  3. Patch to the vendor-designated fixed build. Do not accept "latest" as a substitute for the specific version enumerated in the advisory.
  4. Hunt. Assume exploitation predates your patch. For UniFi, review controller logs for unexpected admin changes, new local accounts, and unusual outbound connections from the controller itself. For EDS5000, look for unexpected reboots, config changes, or telnet/SSH sessions originating from the device. For Splunk, look for unexpected file writes under Splunk-owned paths and for the PostgreSQL sidecar endpoint being reached from unusual sources. For Joomla, enumerate editor profiles and inspect uploads directories for PHP files with recent mtimes.
  5. Prove it. Every step above should produce an artifact you can hand an auditor: a ticket, a scan output, a diff of the config, a hunt query with results.

KEV entries matter not because they surface new information, but because they collapse ambiguity: the vulnerability is being exploited, the fix exists, the deadline is set. What remains is execution. Execution is either evidenced or it is not.

Verifiable security.