# Ubiquiti Emergency: Seven Critical Flaws Expose Entire UniFi Suite to Network-Based Takeover


Ubiquiti has patched seven critical vulnerabilities spanning its core UniFi product line—Connect, Talk, Access, Protect, and OS—that could allow network-adjacent attackers to escalate privileges and execute arbitrary commands on critical infrastructure devices. The flaws range from CVSS 9.0 to a perfect 10.0, with some requiring only network access and no authentication to exploit.


## The Threat


On July 8, 2026, Ubiquiti released patches addressing a coordinated set of severe access control, injection, and input validation flaws across its UniFi unified management platform. The vulnerabilities affect products deployed in thousands of enterprises for network access control, physical security, video surveillance, and VoIP infrastructure—making this a broad-spectrum risk to organizations that rely on Ubiquiti's ecosystem.


The most critical flaw, CVE-2026-50746 (CVSS 10.0), is an improper access control vulnerability in UniFi Connect that allows unauthenticated command injection from the network. Equally severe are CVE-2026-50747 and CVE-2026-50748, both scoring 9.9, which enable SQL injection and command injection respectively across UniFi Talk and Access platforms. A Server-Side Request Forgery (SSRF) flaw in UniFi Protect (CVE-2026-55115) further expands the attack surface, allowing privilege escalation through internal network requests.


What elevates this beyond a typical patch cycle is context: Ubiquiti disclosed last month that three UniFi OS vulnerabilities (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) were actively weaponized in real-world attacks, triggering a CISA alert. Russian state-sponsored threat actors have independently demonstrated operational capability against Ubiquiti infrastructure by compromising Edge OS routers for the MooBot botnet—eventually dismantled in a February 2024 law enforcement operation. The recurring pattern of Ubiquiti products being targeted by sophisticated actors suggests these latest flaws may not remain theoretical for long.


## Severity and Impact


| CVE ID | Product | CVSS Score | Vulnerability Type | Attack Vector | Auth Required | Affected Versions | Fixed Version |

|--------|---------|------------|-------------------|----------------|----------------|-------------------|----------------|

| CVE-2026-50746 | UniFi Connect | 10.0 | Improper Access Control / Command Injection | Network | None | ≤ 3.4.16 | 3.4.20 |

| CVE-2026-50747 | UniFi Talk | 9.9 | Authenticated SQL Injection | Network | Yes | ≤ 5.1.2 | 5.2.2 |

| CVE-2026-50748 | UniFi Access | 9.9 | Improper Input Validation / Command Injection | Network | None | ≤ 4.2.28 | 4.2.29 |

| CVE-2026-54400 | UniFi Access | 9.1 | Improper Access Control | Network | None | ≤ 4.2.28 | 4.2.29 |

| CVE-2026-55115 | UniFi Protect | 9.9 | Server-Side Request Forgery (SSRF) | Network | Low Privilege | ≤ 7.1.77 | 7.1.83 |

| CVE-2026-54402 | UniFi OS | 9.9 | Improper Input Validation / Command Injection | Network | None | ≤ 5.1.15 | 5.1.19 |

| CVE-2026-55116 | UniFi OS | 9.0 | Improper Access Control | Network | None | ≤ 5.1.15 | 5.1.19 |


## Affected Products


UniFi Connect:

  • Versions 3.4.16 and earlier (update to 3.4.20)

    • UniFi Talk:

  • Versions 5.1.2 and earlier (update to 5.2.2)

    • UniFi Access:

  • Versions 4.2.28 and earlier (update to 4.2.29)

    • UniFi Protect:

  • Versions 7.1.77 and earlier (update to 7.1.83)

    • UniFi OS:

  • Versions 5.1.15 and earlier (update to 5.1.19)

    • ## Mitigations


    Ubiquiti strongly recommends immediate patching across all affected products:


  • Firmware Updates: Deploy the fixed versions listed above as soon as possible. UniFi Connect should be updated to 3.4.20; UniFi Talk to 5.2.2; UniFi Access and Protect to their respective latest versions; UniFi OS to 5.1.19.
  • Network Segmentation: If immediate patching is not feasible, restrict network access to UniFi management interfaces and deployment controllers from trusted administrative networks only. Isolate UniFi infrastructure from general production networks.
  • Access Control: Disable remote management features if not actively required. Review and restrict authentication privileges within UniFi applications to the minimum necessary.
  • Monitoring: Enable enhanced logging on UniFi devices and monitor for suspicious command injection attempts, SQL queries, or unauthorized access attempts. Alert on any SSRF-related outbound connections from Protect controllers.
  • Change Credentials: After patching, reset administrative credentials for all UniFi applications to prevent credential reuse by attackers who may have previously compromised systems.
  • Testing: Verify patches in a lab environment before production deployment to ensure compatibility with downstream integrations (access badge readers, surveillance systems, VoIP endpoints).

    • ## References


  • Ubiquiti Security Advisories: https://support.ubiquiti.com/hc/en-us/articles/security-advisories
  • CISA Alert (Prior UniFi OS Weaponization): https://www.cisa.gov/alerts
  • NVD CVE Database: https://nvd.nist.gov/vuln/detail/CVE-2026-50746

    • ---


    ## HackWire Analysis


    Ubiquiti's UniFi platform occupies a critical position in enterprise infrastructure: it unifies network switches, wireless access points, security cameras, physical access control, and VoIP systems under a single management console. That consolidation—which is the product's core selling point—becomes a single point of failure when vulnerabilities cluster like this.


    The timing is also telling. Ubiquiti patched weaponized flaws just last month; now, another seven critical vulnerabilities demand attention. This is not a one-off disclosure but evidence of either (1) systematic vulnerability discovery in a legacy codebase that was never designed for adversarial scrutiny, or (2) a product line that has become a high-value target for security research, threat intelligence, and active exploitation.


    The fact that Russian state-sponsored actors have already demonstrated operational exploitation of Ubiquiti Edge OS routers for botnet infrastructure suggests they maintain active interest in Ubiquiti's attack surface. The transition from Edge OS to UniFi is minimal—UniFi is the managed version of the same underlying OS. Organizations deploying UniFi should assume these vulnerabilities will be exploited if not patched quickly.


    The presence of an unauthenticated command injection flaw (CVE-2026-50746, CVSS 10.0) in UniFi Connect is particularly dangerous because it requires only network connectivity—no valid credentials, no social engineering. Any employee on a corporate network, or any attacker who has compromised the network perimeter, can potentially gain code execution on the UniFi controller. From there, lateral movement across access control systems, surveillance infrastructure, and network fabric is trivial.


    Organizations should treat this as a critical incident response priority, not a routine patch Tuesday. Delay increases the window of exposure for already-targeted infrastructure. — *HackWire Editorial*


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)