Ubiquiti has released security updates to address seven vulnerabilities in its UniFi OS, including a critical flaw that could allow for command injection. The most severe of these, CVE-2026-50746, carries a CVSS score of 10.0 and affects the UniFi Connect Application, versions 3.4.16 and earlier. This application is used for managing commercial building systems like smart lighting and EV chargers.
The critical command injection vulnerability in UniFi Connect Application could be exploited by a malicious actor with network access. Such an attacker could execute arbitrary commands on the host device, potentially leading to a full system compromise. Ubiquiti advises organizations using affected versions to update their systems promptly to mitigate this risk.
In addition to the critical flaw, Ubiquiti also patched several other high-severity vulnerabilities. CVE-2026-50747, a SQL injection vulnerability in the UniFi Talk Application, and CVE-2026-50748, an improper input validation flaw in the UniFi Access Application, both carry a CVSS score of 9.9. These issues could allow a low-privileged attacker with network access to escalate privileges or execute commands on the host device.
Further vulnerabilities include CVE-2026-54400 (CVSS 9.1) in UniFi Access Application, which allows a high-privileged attacker to escalate privileges due to improper access control. CVE-2026-54402 (CVSS 9.9) affects multiple UniFi OS devices and enables privilege escalation through an SSRF vulnerability exploitable by a low-privileged attacker with network access.
Two other vulnerabilities addressed are CVE-2026-55115 (CVSS 9.9) in UniFi OS/UniFi Protect environments, related to a CORS misconfiguration that could allow an attacker to abuse a victim's authenticated session for unauthorized actions, and CVE-2026-55116 (CVSS 9.0), an improper access control issue on certain UniFi OS devices that could permit unauthorized changes under specific network conditions.
Ubiquiti recommends users update to the fixed versions detailed in Security Advisory Bulletin 066. The company has not confirmed any instances of these specific vulnerabilities being exploited in the wild. However, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) previously added other Ubiquiti UniFi OS vulnerabilities to its Known Exploited Vulnerabilities catalog in June, indicating a history of active exploitation of issues within the platform.
