# CVE-2026-50746: Critical Unauthenticated Command Injection in Ubiquiti UniFi Connect Application (CVSS 10.0)

> Ubiquiti's UniFi Connect Application versions 3.4.16 and earlier contain a maximum-severity (CVSS 10.0) improper access control flaw (CWE-284) that allows a network-adjacent, unauthenticated attacker to execute arbitrary OS commands on the host device. Disclosed in Security Advisory Bulletin 066 (SAB-066) alongside six other critical UniFi ecosystem vulnerabilities; patched in version 3.4.20.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-18T18:08:13.154Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1159
- **ID:** TL-2026-1159
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-50746, CVE-2026-50747, CVE-2026-50748, CVE-2026-54400, CVE-2026-54402, CVE-2026-54403, CVE-2026-55115, CVE-2026-55116, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910

## Description

CVE-2026-50746 is an improper access control vulnerability (CWE-284) in the UniFi Connect Application, the Ubiquiti software suite used to manage commercial building automation systems — including smart LED lighting and electric vehicle (EV) charging infrastructure — through a unified web interface. The flaw exposes internal functionality that should be access-restricted, allowing a malicious actor with only network reachability to the service (no authentication, no privileges, no user interaction) to inject and execute arbitrary operating-system commands on the host running UniFi Connect.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects the worst-case combination for an internet/network-exposed management product: network attack vector, low attack complexity, no privileges required, no user interaction, a scope change (the vulnerable component impacts resources beyond its own security scope — consistent with host-level command execution from an application-layer flaw), and complete loss of confidentiality, integrity, and availability. This combination yields the maximum possible base score of 10.0.

The vulnerability was disclosed by Ubiquiti on 2026-07-02 (NVD publish date) as part of Security Advisory Bulletin 066 (SAB-066), a coordinated disclosure covering 25 vulnerabilities across the UniFi product ecosystem (Connect, Talk, Access, Protect, Network Application, and core UniFi OS on UDM/UNVR/UNAS hardware). CVE-2026-50746 was the single most severe finding in that bulletin. Six other critical-tier vulnerabilities were patched in the same release cycle: CVE-2026-50747 (9.9, authenticated SQL injection in UniFi Talk), CVE-2026-50748 (9.9, command injection / input validation bypass in UniFi Access), CVE-2026-54400 (9.1, privilege escalation in UniFi Access), CVE-2026-54402 (9.9, command injection/SSRF affecting UniFi OS on UDM/UNVR/UNAS hardware), CVE-2026-55115 (9.9, SSRF-driven privilege escalation / CORS misconfiguration in UniFi Protect), and CVE-2026-55116 (9.0, improper access control enabling unauthorized configuration changes on UDM gateway devices). Ubiquiti also disclosed CVE-2026-54403 (8.6, path traversal), explicitly noted as chainable with other SAB-066 flaws to bypass authentication entirely — illustrating that several of these issues were designed to be exploited together in a single intrusion chain rather than in isolation.

As of publication, no functional public proof-of-concept exploit is known and Ubiquiti has not disclosed evidence of active exploitation; CISA's ADP/SSVC assessment for CVE-2026-50746 records exploitation status as "none." However, exposure research cited by multiple outlets found more than 100,000 UniFi OS instances reachable on the public internet (roughly 50,000 in the United States alone), and Ubiquiti's own advisory states no interim workarounds exist for any of the 25 SAB-066 findings — firmware/application updates are the only mitigation. This threat is also notable because CISA's KEV catalog already lists three prior UniFi OS vulnerabilities exploited in the wild (CVE-2026-34908 improper access control, CVE-2026-34909 path traversal, CVE-2026-34910 command injection, all added to KEV 2026-06-23), establishing a documented pattern of real-world attacker interest in this exact vulnerability class (unauthenticated command injection / access-control bypass) against UniFi OS-family products just weeks before SAB-066. Defenders should treat CVE-2026-50746 as a high-priority patching target given this precedent, the perfect CVSS score, and the scale of internet-facing exposure, even absent a confirmed public exploit at this time.

## MITRE ATT&CK

- T1595.001 Active Scanning: Scanning IP Blocks
- T1590.004 Gather Victim Network Information: Network Topology
- T1587.004 Develop Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1203 Exploitation for Client Execution
- T1505.003 Server Software Component: Web Shell
- T1136.001 Create Account: Local Account
- T1068 Exploitation for Privilege Escalation
- T1070.003 Indicator Removal: Clear Command History
- T1211 Exploitation for Stealth
- T1003 OS Credential Dumping
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1090.003 Proxy: Multi-hop Proxy
- T1498 Network Denial of Service
- T1529 System Shutdown/Reboot
- T1199 Trusted Relationship
- T1518 Software Discovery
- T1548 Abuse Elevation Control Mechanism
- T1686 Disable or Modify System Firewall
- T1552.001 Unsecured Credentials: Credentials In Files
- T1040 Network Sniffing
- T1021 Remote Services
- T1119 Automated Collection
- T1071.001 Application Layer Protocol: Web Protocols
- T0831 Manipulation of Control

## Sources

- [SOCRadar: Ubiquiti Fixes CVE-2026-50746 in UniFi Connect](https://socradar.io/blog/ubiquiti-cve-2026-50746-unifi-connect/)
- [Ubiquiti Security Advisory Bulletin 066](https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc)
- [Ubiquiti Disclosed 25 Security Vulnerabilities Across the UniFi Ecosystem](https://cybersecuritynews.com/ubiquiti-disclosed-25-flaws/)
- [Ubiquiti warns of new max severity UniFi OS vulnerability](https://www.bleepingcomputer.com/news/security/ubiquiti-warns-of-new-max-severity-unifi-os-vulnerability/)
- [Ubiquiti Patches Critical UniFi OS Flaws Allowing Command Injection and Privilege Escalation](https://securityaffairs.com/194978/security/ubiquiti-patches-critical-unifi-os-flaws-allowing-command-injection-and-privilege-escalation.html)
- [NVD CVE-2026-50746 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-50746)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Ubiquiti patches critical command injection flaw in UniFi Connect - CyberSIXT Summary](https://cybersixt.com/a/7B1Rk-7Jc8EakEc5xfZ65X)
- [UniFi Security Advisory Fixes Command Injection Bugs](https://securityonline.info/unifi-security-advisory-066/)
- [Ubiquiti Unveils 25 Security Vulnerabilities in UniFi Ecosystem](https://www.news4hackers.com/ubiquiti-unveils-25-security-vulnerabilities-in-unifi-ecosystem)
- [Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS](https://thehackernews.com/2026/07/ubiquiti-patches-critical-unifi-flaws.html)
- [CISA Adds Four Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/06/23/cisa-adds-four-known-exploited-vulnerabilities-catalog)
- [Critical Ubiquiti Vulnerabilities in Attackers' Crosshairs](https://www.securityweek.com/critical-ubiquiti-vulnerabilities-in-attackers-crosshairs/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1159