Affected Systems

Ubiquiti UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS. Specific vulnerable versions not provided in available data. CVE-2026-50746 rated CVSS 10.0 (critical).

Exploitation Status

No active exploitation or public PoC reported in available data. Patches released by vendor. Exploitation likelihood high given CVSS 10.0 severity and privilege escalation/command execution capabilities.

Business Impact

Organizations using affected UniFi products face risk of full system compromise via privilege escalation and arbitrary command execution. CVSS 10.0 indicates network-accessible attack vector with no user interaction required. UniFi devices often manage network infrastructure, access control, and surveillance systems—compromise could enable lateral movement, data exfiltration, or physical security bypass. Immediate patching required to prevent potential breach.

Urgency

🔴 Immediate

Recommended Actions

  • Identify all Ubiquiti UniFi Connect, Talk, Access, Protect, and OS devices in your environment via asset inventory or network scanning
  • Apply vendor-released patches immediately for all affected UniFi products, prioritizing internet-facing and critical infrastructure devices
  • Review UniFi device logs for unauthorized access attempts, privilege escalation events, or unexpected command execution prior to patching
  • Restrict network access to UniFi management interfaces using firewall rules or VLANs, limiting exposure to trusted admin networks only
  • Monitor Ubiquiti security advisories for specific CVE details, affected version ranges, and additional IOCs as vendor publishes full disclosure