Ubiquiti Warns of New Critical Vulnerability Affecting UniFi OS
Ubiquiti, a leading provider of networking and IoT solutions, has released security updates to patch seven critical vulnerabilities in its UniFi OS, including one with a maximum-severity rating that can be exploited in command injection attacks. The vulnerability, tracked as CVE-2026-50746, affects the UniFi Connect Application, used by Ubiquiti customers to manage commercial building operations.
The bug is caused by an Improper Access Control vulnerability that allows a malicious actor with access to the network to execute a Command Injection on the host device. This means that if an attacker gains access to the network, they can potentially inject malicious commands into the system, leading to unauthorized access and potentially devastating consequences. Ubiquiti has advised users to update the impacted UniFi Connect app to version 3.4.20 or later to secure their systems against potential attacks.
But CVE-2026-50746 is not an isolated issue. Six other critical-severity security issues were patched in the same update, affecting a wide range of Ubiquiti products, including UniFi Talk, UniFi Access, and UniFi Protect applications, as well as various routers, gateways, NAS, and surveillance systems. These vulnerabilities can be exploited in low-complexity attacks that don’t require user interaction, making them particularly concerning.
According to threat intelligence company Censys, over 100,000 UniFi OS instances are currently exposed online, with nearly 50,000 of those IP addresses located in the United States. While it’s unclear how many of these systems have already been secured against these security flaws or are honeypots, the sheer number of vulnerable devices is alarming.
The fact that state-sponsored threat groups and cybercrime hacking groups have targeted Ubiquiti products in recent years, using them to build botnets designed to conceal malicious activity, only adds to the concern. In February 2024, the FBI dismantled Moobot, a botnet of Ubiquiti Edge OS routers used by Russia’s Main Intelligence Directorate of the General Staff (GRU) to proxy malicious traffic in cyberespionage attacks.
This latest vulnerability is a stark reminder that security teams must be vigilant and proactive in protecting their systems against potential threats. With many organizations still relying on outdated or vulnerable devices, it’s essential to prioritize regular security updates, patch management, and penetration testing to stay ahead of attackers. As the recent CISA warnings demonstrate, the consequences of neglecting these best practices can be severe.
So what can you do to protect your systems? Start by prioritizing regular security updates and patch management. Ensure that all devices, including routers and IoT appliances, are up-to-date with the latest firmware and software patches. Additionally, consider conducting penetration testing and vulnerability scanning to identify potential weaknesses in your network. By taking these steps, you can significantly reduce the risk of a successful attack and protect your organization from the devastating consequences of a data breach.
Source: Bleeping Computer — 2026-07-08