Ubiquiti Patches Critical UniFi OS Flaws Allowing Command Injection and Privilege Escalation
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-34910 | Unauthenticated Command Injection in Ubiquiti UniFi OS Devices CVE-2026-34910 is an improper input validation flaw (CWE-20) in Ubiquiti UniFi OS that allows command injection on affected gateways and network video recorders. A malicious actor with network access to the device can send crafted, unvalidated input that triggers arbitrary command execution, with no privileges or user interaction required (CVSS 3.1 base score 10.0, network vector, scope changed). Successful exploitation grants full control of the device — high confidentiality, integrity, and availability impact — and can serve as a foothold into the attached network. Affected products span the UniFi gateway and recording line: UniFi OS Server, Cloud Gateway Industrial, Dream Machine/Pro/Special Edition/Pro Max, Enterprise Fortress Gateway, Dream Wall, Dream Router and Dream Router 7, UniFi Express 7, and the UniFi Network Video Recorder. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-23, public reporting describes in-the-wild exploitation being used to build a Mirai botnet, and EPSS estimates an 87.5% chance of exploitation within 30 days. Do: Upgrade all listed UniFi OS devices to the fixed firmware in Ubiquiti's June 2026 security advisory (consult the vendor advisory for exact fixed versions per product), and per CISA BOD 26-04 patch within the required window or discontinue use of affected cloud-reachable assets. Restrict device management interfaces (UniFi Network UI, SSH, API) to trusted networks and audit internet-facing gateways for signs of compromise, including Mirai botnet traffic or unexpected outbound connections. | 10.0 | 87% | KEV PoC |
| mass≈1M+ UniFi gateways/NVRs deployed worldwide, with on the order of hundreds of thousands internet-exposed | |
| CVE-2026-50746 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Inje A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Injection on the host device. NVD description · AI analysis pending | 10.0 | 2% |
| — | ||
| CVE-2026-50747 | A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Applic A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device. NVD description · AI analysis pending | 9.9 | <1% |
| — | ||
| CVE-2026-50748 +1 in the same advisory: …54400 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to ex A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device. NVD description · AI analysis pending | 9.9 group max | 2% |
| — | ||
| CVE-2026-54402 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device. NVD description · AI analysis pending | 8.8 | 2% |
| — | ||
| CVE-2026-55115 | A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate priv A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device. NVD description · AI analysis pending | 9.9 | <1% |
| — | ||
| CVE-2026-55116 | A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain de A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices. NVD description · AI analysis pending | 9.8 | <1% |
| — |
Full article415 words · extracted from securityaffairs.com · click to collapse
Ubiquiti patched seven UniFi OS flaws, including critical CVE-2026-50746, which allows command injection in UniFi Connect Application.
Ubiquiti released security updates for seven critical UniFi OS vulnerabilities, including a maximum-severity flaw, tracked as CVE-2026-50746 (CVSS score of 10.0), enabling command injection attacks.
The issue affects UniFi Connect Application versions 3.4.16 and earlier, a platform used to manage commercial building systems such as smart lighting and EV chargers. Organizations using affected versions should update promptly to reduce compromise risks.
“A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Injection on the host device.” reads the advisory.
The vendor also addressed thcritical vulnerabilities:
- CVE-2026-50747 (CVSS score of 9.9): The vulnerability affects UniFi Talk Application and consists of authenticated SQL injection flaws. A low-privileged attacker with network access can exploit the issue to escalate privileges and gain greater control over the host device.
- CVE-2026-50748 (CVSS score of 9.9): The vulnerability affects UniFi Access Application and is caused by improper input validation. A low-privileged attacker with network access can exploit the flaw to execute commands on the host device.
- CVE-2026-54400 (CVSS score of 9.1): The vulnerability affects UniFi Access Application and is caused by improper access control. A high-privileged attacker can exploit it to escalate privileges on the affected host device.
- CVE-2026-54402 (CVSS score of 9.9): The vulnerability affects multiple UniFi OS devices and allows a low-privileged attacker with network access to exploit an SSRF vulnerability, potentially leading to privilege escalation within UniFi OS environments.
- CVE-2026-55115 (CVSS score of 9.9): The vulnerability affects UniFi OS/UniFi Protect environments and is related to a CORS misconfiguration. An attacker can abuse a victim’s authenticated session to perform unauthorized actions.
- CVE-2026-55116 (CVSS score of 9.0): The vulnerability affects certain UniFi OS devices and allows unauthorized changes through an improper access control issue under specific network conditions.
Ubiquiti recommends updating affected products to the fixed versions listed in Security Advisory Bulletin 066.
Ubiquiti has not confirmed whether any of the vulnerabilities were exploited in attacks in the wild.
In June, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following Ubiquiti UniFi OS issues to its Known Exploited Vulnerabilities (KEV) catalog.
- CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation Vulnerability
- CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability
- CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/194978/security/ubiquiti-patches-critical-unifi-os-flaws-allowing-command-injection-and-privilege-escalation.html