Ubiquiti has released security updates to patch seven critical vulnerabilities in UniFi OS, including a maximum-severity flaw tracked as CVE-2026-50746 that can be exploited in command injection attacks. The CVE-2026-50746 vulnerability affects UniFi Connect Application (versions 3.4.16 and earlier), a management software suite that Ubiquiti customers can use to automate and manage commercial building operations (including smart LED lighting systems and electric vehicle chargers) via a single interface. "A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Injection on the host device," Ubiquiti explained. The company advised users to update the impacted UniFi Connect app to version 3.4.20 or later to secure their systems against potential attacks. On Thursday, Ubiquiti patched six more critical-severity security issues (CVE-2026-50747, CVE-2026-50748, CVE-2026-54400, CVE-2026-54402, CVE-2026-55115, CVE-2026-55116) in the UniFi Talk, UniFi Access, and UniFi Protect applications, in the company's UniFi OS Server, and across a wide range of Ubiquiti routers, gateways, NAS, and surveillance systems. Ubiquiti has yet to disclose whether any of these vulnerabilities were exploited in the wild before being addressed, but shared that six of them can be exploited in low-complexity attacks that don't require user interaction. Threat intelligence company Censys now tracks over 100,00...
Ubiquiti warns of new max severity UniFi OS vulnerability
BleepingComputer
·Sergiu Gatlan
·Published Jul 8, 2026
·Updated
Affected Software
6 affected components
Ubiquiti UniFi Connect Application<=3.4.16
Ubiquiti UniFi Talk
Ubiquiti Unifi Access
Ubiquiti UniFi Protect
Ubiquiti UniFi OS Server
Ubiquiti Ubiquiti routers, gateways, NAS, and surveillance systems (via UniFi OS)
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses the release of security updates by Ubiquiti to patch critical vulnerabilities in UniFi OS, including a high-severity flaw.
2
What critical vulnerability is highlighted in the article?
The article highlights a maximum-severity vulnerability tracked as CVE-2026-50746 that can be exploited in command injection attacks.
3
Which Ubiquiti products are affected by the vulnerabilities?
Affected products include the UniFi Connect Application, UniFi OS Server, UniFi Talk, UniFi Access, UniFi Protect, and various other UniFi OS systems.
4
What actions should users take in response to this security warning?
Users should apply the latest security updates provided by Ubiquiti to mitigate these vulnerabilities.
5
How does the CVE-2026-50746 vulnerability pose a security risk?
The CVE-2026-50746 vulnerability allows attackers to potentially execute command injection attacks, posing a severe security risk to affected systems.