LIVE · cybersecurity feed
ubiquiticriticalCVE-2026-50746

Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS

zeroday.news·3h ago

Ubiquiti has issued patches for multiple critical security vulnerabilities discovered across its UniFi ecosystem. The affected products include UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS. These vulnerabilities pose significant risks, potentially enabling attackers to gain elevated privileges or execute arbitrary commands on vulnerable systems.

The vulnerabilities identified include CVE-2026-50746, a critical flaw in UniFi Connect Application (CVSS 10.0) that allows for command injection. In UniFi Talk Application, CVE-2026-50747 (CVSS 9.9) presents authenticated SQL injection risks leading to privilege escalation.

UniFi Access Application is affected by two vulnerabilities: CVE-2026-50748 (CVSS 9.9) for command injection and CVE-2026-54400 (CVSS 9.1) for privilege escalation, both stemming from improper access control or input validation.

Furthermore, UniFi Protect Application has a Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-55115 (CVSS 9.9), which can be exploited by low-privileged attackers to escalate their privileges.

UniFi OS itself is not immune, with CVE-2026-54402 (CVSS 9.9) allowing for command injection and CVE-2026-55116 (CVSS 9.0) enabling unauthorized changes to device configurations, both due to improper input validation and access control issues.

While there is currently no indication that these newly patched vulnerabilities have been actively exploited in the wild, Ubiquiti's products have been targeted previously. Notably, three other vulnerabilities in UniFi OS were recently identified by CISA as being weaponized in real-world attacks.

Additionally, Russian state-sponsored threat actors were previously observed using compromised Ubiquiti Edge OS routers as part of a botnet known as MooBot, which was disrupted by law enforcement in February 2024. This history underscores the importance of timely patching for Ubiquiti devices.

ubiquitiunifivulnerabilitynetwork securitycommand injection
← Back to latest

More News

view all →
zeroday.news · 2h ago·high

China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors

A China-linked advanced persistent threat (APT) group, identified as LapDogs, has reportedly enhanced its malicious toolkit. Security researchers have observed the deployment of three new backdoors: LongLeash, DogLeash, and JarLeash, which are designed to compromise small office/home office (SOHO) routers.

zeroday.news · 2h ago·high

RedWing Android Spyware Sold as a Service on Telegram

A new Android spyware called RedWing is being offered as a service on Telegram, allowing less sophisticated attackers to compromise phones and steal banking information. Researchers have identified it as a polished malware-as-a-service operation with extensive documentation and a subscription model, potentially linked to Russian threat actors. RedWing employs fake login overlays, SMS interception, call forwarding, and even screen control to harvest credentials and conduct further malicious activities.

zeroday.news · 3h ago·high

Operationalizing Day Minus Seven: The Cloud-Native ROC

The article introduces the concept of a Risk Operations Center (ROC) as a necessary evolution for cybersecurity teams facing AI-driven threats. It argues that traditional risk management models are insufficient due to the speed at which AI can discover and exploit vulnerabilities, especially in cloud environments. A ROC, powered by platforms like Qualys Enterprise TruRisk Management (ETM), aims to unify disparate security findings, hyper-prioritize risks based on exploitability and business impact, and enable autonomous remediation to keep pace with attackers.

zeroday.news · 3h ago·high

Armored Likho Hits Government, Energy Sectors With BusySnake Stealer

Cybersecurity researchers have identified a new threat actor, dubbed Armored Likho, targeting government and energy sectors in Russia, Kazakhstan, and Brazil with a sophisticated phishing campaign. The operation utilizes a custom-built Python infostealer named BusySnake, designed to steal credentials, sensitive documents, and other high-value data. The attackers employ AI-generated payloads to obscure their activities and maintain persistence through various methods, including reverse SSH tunneling.

zeroday.news · 3h ago·critical

Attackers using Langflow flaw for credential harvesting (CVE-2026-55255)

CISA has issued a warning regarding a critical vulnerability (CVE-2026-55255) in the Langflow AI framework, which is being actively exploited by attackers. The flaw allows authenticated users to execute arbitrary flows belonging to other users, potentially leading to the theft of sensitive credentials and data exposure, especially in multi-tenant environments. US federal agencies have been mandated to patch this vulnerability by July 10th.

zeroday.news · 3h ago·high

3 Ways AI Powers Service Desk Attacks and How to Prevent Them

Artificial intelligence is increasingly being used by attackers to enhance service desk attacks, particularly during employee onboarding. AI tools can create more convincing impersonations, accelerate reconnaissance for personalized attacks, and scale malicious campaigns. To counter these threats, organizations need to implement stronger identity verification methods, such as secure password delivery, biometric liveness detection, and multi-factor authentication before sensitive actions are approved.