CVE-2026-50748

—

CVSS 3.1

9.9 critical

EPSS

2%p75

Published

Jul 2, 2026 (Jul 2, 2026)

Modified

Aug 17, 2026

Description

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

Vendors: ui
Products: unifi access
Weakness: CWE-20
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news3 stories

⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More

The Hacker NewsAug 4, 12:16 UTC · Aug 4, 2026Ransomware CVE-2026-50746 CVE-2026-50747 CVE-2026-50748+45 CVEs

Ubiquiti Patches Critical UniFi OS Flaws Allowing Command Injection and Privilege Escalation

Security AffairsJul 8, 20:21 UTC · Jul 8, 2026Vulnerability in the wildCVE-2026-50746 CVE-2026-50747 CVE-2026-50748+7 CVEs

Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS

The Hacker NewsJul 8, 14:38 UTC · Jul 8, 2026Vulnerability in the wildCVE-2026-50746 CVE-2026-50747 CVE-2026-50748+7 CVEs