CVE-2026-50746: Critical Unauthenticated Command Injection in Ubiquiti UniFi Connect Application (CVSS 10.0)

CVE-2026-50746 (TL-2026-1159), also tracked as SAB-066, is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-10 and last reviewed 2026-07-18. It has no confirmed attribution, affects Ubiquiti Inc UniFi Connect Application, references 11 CVEs (CVE-2026-50746, CVE-2026-50747, CVE-2026-50748), maps to 31 MITRE ATT&CK techniques (T0831, T1003, T1005), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-1159

Threat ID
TL-2026-1159
Also known as
SAB-066, Security Advisory Bulletin 066
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-10
Last reviewed
2026-07-18
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
commercialrealestate, smartbuildingautomation, hospitality, retail, criticalinfrastructureadjacent, smallmediumbusiness, managedserviceproviders
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
27
Updates
2026-07-18 · revalidated 1× · latest source

Ubiquiti's UniFi Connect Application versions 3.4.16 and earlier contain a maximum-severity (CVSS 10.0) improper access control flaw (CWE-284) that allows a network-adjacent, unauthenticated attacker to execute arbitrary OS commands on the host device. Disclosed in Security Advisory Bulletin 066 (SAB-066) alongside six other critical UniFi ecosystem vulnerabilities; patched in version 3.4.20.

How CVE-2026-50746 works

CVE-2026-50746 is an improper access control vulnerability (CWE-284) in the UniFi Connect Application, the Ubiquiti software suite used to manage commercial building automation systems — including smart LED lighting and electric vehicle (EV) charging infrastructure — through a unified web interface. The flaw exposes internal functionality that should be access-restricted, allowing a malicious actor with only network reachability to the service (no authentication, no privileges, no user interaction) to inject and execute arbitrary operating-system commands on the host running UniFi Connect.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects the worst-case combination for an internet/network-exposed management product: network attack vector, low attack complexity, no privileges required, no user interaction, a scope change (the vulnerable component impacts resources beyond its own security scope — consistent with host-level command execution from an application-layer flaw), and complete loss of confidentiality, integrity, and availability. This combination yields the maximum possible base score of 10.0.

The vulnerability was disclosed by Ubiquiti on 2026-07-02 (NVD publish date) as part of Security Advisory Bulletin 066 (SAB-066), a coordinated disclosure covering 25 vulnerabilities across the UniFi product ecosystem (Connect, Talk, Access, Protect, Network Application, and core UniFi OS on UDM/UNVR/UNAS hardware). CVE-2026-50746 was the single most severe finding in that bulletin. Six other critical-tier vulnerabilities were patched in the same release cycle: CVE-2026-50747 (9.9, authenticated SQL injection in UniFi Talk), CVE-2026-50748 (9.9, command injection / input validation bypass in UniFi Access), CVE-2026-54400 (9.1, privilege escalation in UniFi Access), CVE-2026-54402 (9.9, command injection/SSRF affecting UniFi OS on UDM/UNVR/UNAS hardware), CVE-2026-55115 (9.9, SSRF-driven privilege escalation / CORS misconfiguration in UniFi Protect), and CVE-2026-55116 (9.0, improper access control enabling unauthorized configuration changes on UDM gateway devices). Ubiquiti also disclosed CVE-2026-54403 (8.6, path traversal), explicitly noted as chainable with other SAB-066 flaws to bypass authentication entirely — illustrating that several of these issues were designed to be exploited together in a single intrusion chain rather than in isolation.

As of publication, no functional public proof-of-concept exploit is known and Ubiquiti has not disclosed evidence of active exploitation; CISA's ADP/SSVC assessment for CVE-2026-50746 records exploitation status as "none." However, exposure research cited by multiple outlets found more than 100,000 UniFi OS instances reachable on the public internet (roughly 50,000 in the United States alone), and Ubiquiti's own advisory states no interim workarounds exist for any of the 25 SAB-066 findings — firmware/application updates are the only mitigation. This threat is also notable because CISA's KEV catalog already lists three prior UniFi OS vulnerabilities exploited in the wild (CVE-2026-34908 improper access control, CVE-2026-34909 path traversal, CVE-2026-34910 command injection, all added to KEV 2026-06-23), establishing a documented pattern of real-world attacker interest in this exact vulnerability class (unauthenticated command injection / access-control bypass) against UniFi OS-family products just weeks before SAB-066. Defenders should treat CVE-2026-50746 as a high-priority patching target given this precedent, the perfect CVSS score, and the scale of internet-facing exposure, even absent a confirmed public exploit at this time.

MITRE ATT&CK techniques used in TL-2026-1159

Impact

T0831 Manipulation of Control; T1498 Network Denial of Service; T1529 System Shutdown/Reboot

Credential Access

T1003 OS Credential Dumping; T1552.001 Unsecured Credentials: Credentials In Files

Collection

T1005 Data from Local System; T1119 Automated Collection

Discovery

T1016 System Network Configuration Discovery; T1040 Network Sniffing; T1046 Network Service Discovery; T1082 System Information Discovery; T1518 Software Discovery

Lateral Movement

T1021 Remote Services; T1210 Exploitation of Remote Services

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Defense Evasion

T1070.003 Indicator Removal: Clear Command History; T1211 Exploitation for Stealth

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090.003 Proxy: Multi-hop Proxy

Persistence

T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Resource Development

T1587.004 Develop Capabilities: Exploits

Reconnaissance

T1590.004 Gather Victim Network Information: Network Topology; T1595.001 Active Scanning: Scanning IP Blocks

defense-impairment

T1686 Disable or Modify System Firewall

Affected products and versions in CVE-2026-50746

  • Ubiquiti Inc — UniFi Connect Application
    Vulnerable versions: 3.4.16 and earlier
    Fixed in: 3.4.20
  • Ubiquiti Inc — UniFi Talk Application
    Vulnerable versions: versions affected by CVE-2026-50747, prior to SAB-066 fix
    Fixed in: SAB-066 patched release
  • Ubiquiti Inc — UniFi Access Application
    Vulnerable versions: versions affected by CVE-2026-50748 and CVE-2026-54400, prior to SAB-066 fix
    Fixed in: SAB-066 patched release
  • Ubiquiti Inc — UniFi Protect
    Vulnerable versions: versions affected by CVE-2026-55115, prior to SAB-066 fix
    Fixed in: SAB-066 patched release
  • Ubiquiti Inc — UniFi OS (UDM/UNVR/UNAS hardware)
    Vulnerable versions: versions affected by CVE-2026-54402, CVE-2026-54403, CVE-2026-55116, prior to SAB-066 fix
    Fixed in: SAB-066 patched release

Remediation for CVE-2026-50746

Patches

  • UniFi Connect Application 3.4.20 or later (fixes CVE-2026-50746)

Immediate actions

  • Update UniFi Connect Application to version 3.4.20 or later immediately
  • Identify and inventory all UniFi Connect Application instances (used for smart LED lighting and EV charger management) reachable from any network segment
  • Remove UniFi Connect / UniFi OS management interfaces from direct public internet exposure; place behind VPN or management-plane access controls
  • Review firewall/ACL rules restricting network access to the UniFi Connect service to only trusted management hosts
  • Audit UniFi OS device logs for anomalous command execution or unexpected process spawning around the July 2026 disclosure window

Workarounds

  • None published by Ubiquiti; SAB-066 explicitly states no interim workaround exists for any of the 25 disclosed vulnerabilities

Longer-term hardening

  • Establish a recurring patch-management cadence for UniFi OS ecosystem products given the repeated pattern of critical command-injection/access-control CVEs (CVE-2026-34908/34909/34910 exploited in the wild; CVE-2026-50746/50747/50748/54400/54402/54403/55115/55116 disclosed in SAB-066)
  • Deploy network segmentation isolating building-automation/IoT management systems (UniFi Connect, EV chargers, lighting controllers) from corporate and internet-facing networks
  • Deploy behavioral EDR/host monitoring on hosts running UniFi Connect Application capable of detecting anomalous child-process execution from the application
  • Subscribe to Ubiquiti security advisory bulletins and CISA KEV updates to track newly exploited UniFi OS vulnerabilities

CVEs associated with CVE-2026-50746

CVE-2026-50746, CVE-2026-50747, CVE-2026-50748, CVE-2026-54400, CVE-2026-54402, CVE-2026-54403, CVE-2026-55115, CVE-2026-55116, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910

Weaknesses (CWE) in CVE-2026-50746

CWE-284, CWE-89, CWE-22, CWE-918, CWE-346, CWE-77, CWE-78, CWE-362

Timeline of CVE-2026-50746

  • Ubiquiti releases UniFi OS Server version 5.0.8, patching CVE-2026-34908 (improper access control), CVE-2026-34909 (path traversal), and CVE-2026-34910 (command injection) roughly a month before those three flaws are confirmed as actively exploited.
  • CISA adds three prior UniFi OS vulnerabilities (CVE-2026-34908 improper access control, CVE-2026-34909 path traversal, CVE-2026-34910 command injection) to the Known Exploited Vulnerabilities catalog via alert 'CISA Adds Four Known Exploited Vulnerabilities to Catalog', establishing a documented pattern of active exploitation against this vulnerability class in the UniFi OS product family.
  • CISA BOD 26-04 remediation deadline for CVE-2026-34908/34909/34910 — federal civilian agencies required to patch within 3 days of KEV addition given confirmed active exploitation, underscoring the urgency precedent applicable to the newer CVE-2026-50746 disclosure.
  • Ubiquiti publishes Security Advisory Bulletin 066 disclosing 25 vulnerabilities across the UniFi ecosystem (Connect, Talk, Access, Protect, Network Application, and UniFi OS on UDM/UNVR/UNAS hardware), including seven critical-tier CVEs, and releases patched versions with no interim workarounds.
  • CVE-2026-50746 is published in NVD with a CVSS 3.1 base score of 10.0, alongside Ubiquiti's Security Advisory Bulletin 066 (SAB-066) release.
  • Eclypsium's 'Below the Surface' podcast (BTS #78, 'Patching: The Race Against Time') discusses CVE-2026-50746 as a 'perfect CVSS 10' case study on vulnerability discovery/exploitation outpacing patch deployment.
  • SOCRadar blog post on CVE-2026-50746 ingested as the initiating source feed for this threat record (TL-2026-1159).
  • Coverage confirms CVE-2026-50746 was reported to Ubiquiti by security researcher Duc Anh Nguyen (handle @heckintosh_), credited as the discoverer of the flaw in SAB-066.
  • Multiple security outlets (SOCRadar, BleepingComputer, SecurityAffairs, CyberSecurityNews, SecurityOnline, CyberSIXT, TheHackerNews, The420) publish coverage of SAB-066, highlighting CVE-2026-50746 as the most severe entry and noting over 100,000 internet-exposed UniFi OS instances (roughly 50,000 in the United States).
  • Threat-Modeling.com's Vulnerability Intelligence Report documents CVE-2026-50746 as part of a third UniFi disclosure wave, noting 14 new critical UniFi CVEs disclosed across the July 7-9, 2026 window and flagging CVE-2026-50746 for immediate prioritization.
  • NVD record for CVE-2026-50746 last modified, reflecting continued analysis and CISA ADP/SSVC exploitation-status assessment of "none" at time of review.
  • Threat intelligence research completed and documented for TL-2026-1159, establishing patch-priority guidance given the CVSS 10.0 score, internet exposure scale, and precedent of active exploitation against related UniFi OS vulnerabilities.
  • CISA publishes a KEV catalog update adding four other known-exploited vulnerabilities; CVE-2026-50746 is not among them, consistent with no confirmed in-the-wild exploitation as of this date.
  • CISA publishes a further KEV catalog update adding three known-exploited vulnerabilities; CVE-2026-50746 remains absent from the KEV catalog.

Update history for TL-2026-1159

Sources cited for CVE-2026-50746

Threats related to CVE-2026-50746

Detection coverage for TL-2026-1159

As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1159 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats