Improper Access Control Vulnerability in UniFi Connect Application by Ubiquiti
CVE-2026-50746

10CRITICAL

Key Information:

Vendor

Ubiquiti Inc

Status
Unifi Connect Application
Vendor
CVE Published:
2 July 2026

Badges

👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-50746?

A vulnerability exists in the UniFi Connect Application due to improper access control mechanisms. This flaw allows a malicious actor with network access to exploit the system by executing arbitrary commands on the host device. As a result, unauthorized actions could be performed, potentially compromising sensitive data and overall system integrity. Organizations using this application should prioritize security updates and review their network access controls.

Affected Version(s)

UniFi Connect Application 0 < 3.4.20

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Ubiquiti-CVE
Created by HORKimhab

News Articles

favicon imageBleepingComputer

Ubiquiti warns of new max severity UniFi OS vulnerability

Ubiquiti has released security updates to patch seven critical vulnerabilities in UniFi OS, including a maximum-severity flaw that can be exploited in command injection attacks.

References

https://community.ui.com/releases/Security-Advisory-Bulle...

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by BleepingComputer

  • Vulnerability published

  • Vulnerability Reserved

.