Ubiquiti UniFi OS Critical Remote Code Execution and Privilege Escalation Vulnerabilities

Threat Summary

On July 2, 2026, Ubiquiti disclosed and patched seven critical vulnerabilities (including CVE-2026-50746, CVE-2026-50747, CVE-2026-50748, CVE-2026-54400, CVE-2026-54402, CVE-2026-55115, CVE-2026-55116) via Security Advisory Bulletin 066, affecting UniFi Connect, Talk, Access, Protect applications, and UniFi OS Server/Devices. The most severe of these, CVE-2026-50746 (CVSS 10.0), permits remote command injection without authentication or interaction, granting full control over the host device. Attackers on any accessible network segment can exploit these flaws to run arbitrary system commands, escalate privileges, move laterally, harvest credentials, and potentially build botnets or use compromised infrastructure to proxy malicious activities.

At the time of writing, no public exploitation is confirmed for any of the CVEs listed in this bulletin. However, the Ubiquiti product family has been abused by state-sponsored actors for espionage. Risk is especially high for internet-facing devices and those in regulated/government networks. Prior botnets (e.g., Moobot, operated by GRU/APT28) have abused Ubiquiti infrastructure for espionage, emphasizing the potential damage.

Patches have been available since July 2, 2026. Organizations delaying patching remain at highest risk due to the ease of exploitation. There are no known effective workarounds, so patching is the only reliable mitigation.

Recommendations for Ubiquiti UniFi OS Critical Remote Code Execution and Privilege Escalation Vulnerabilities

1. Immediate Patching (CRITICAL):

• • Upgrade UniFi Connect Application to >= 3.4.20
  • UniFi Talk Application: >= 5.2.2
  • UniFi Access Application: >= 4.2.29
  • UniFi Protect Application: >= 7.1.83
  • UniFi OS Server and supported devices (UDM, UCG, UNVR, EF-Core, etc.): >= 5.1.19

Use the official Ubiquiti download portal or built-in update features.

1. Restrict Network Access:

• • Immediately restrict access to all UniFi device management interfaces (HTTP/HTTPS/SSH) via ACLs, firewalls, or VLANs—permit only trusted internal and VPN segments.
  • Remove all direct internet exposure of UniFi OS interfaces.

2. Credential Hygiene:

• • Rotate all administrative passwords, SSH keys, API tokens for UniFi controllers or network devices after patching.

3. Incident Response Preparedness:

• • If compromise is suspected, forensically review the system, remove from network, perform a clean reinstall, and reset all credentials linked to affected infrastructure.

4. Long-term Security Improvements:

• • Segment management networks; adopt a dedicated admin VLAN isolating UniFi controllers/access points from general access.
  • Enforce MFA on all management accounts.
  • Regularly review patch management and credential policies.
  • Survey all Ubiquiti product lines for missing or outdated firmware.

Temporary Workarounds

• No vendor-approved workarounds are effective for these vulnerabilities; patching is mandatory.
• Interim controls if patching is delayed:
  • Use UniFi Zone-Based Firewall (ZBF) to restrict management-interface access to a limited set of internal management hosts or VPN.
  • Move all UniFi OS devices into isolated VLANs, block external WAN-originated traffic, and deny all inbound management except via secure jump hosts.
  • Limit exposure of port 443/TCP, 80/TCP, 8443, 22/SSH to trusted IPs only.
  • Enable device and client isolation settings in UniFi Network settings.
  • Continuously monitor for signs of compromise, but be aware these are temporary measures and do not prevent exploitation of unpatched flaws.

References:

• https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc
• https://www.bleepingcomputer.com/news/security/ubiquiti-warns-of-new-max-severity-unifi-os-vulnerability/
• https://csirts.com/advisory/ncsc-2026-0221-1-00-m-h-vulnerabilities-120093
• https://help.ui.com/hc/en-us/articles/18965560820247-Implementing-Network-and-Client-Isolation-in-UniFi
• https://www.justice.gov/archives/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian