Ubiquiti Patches Critical UniFi OS Flaws Allowing Command Injection and Privilege Escalation

Ubiquiti released patches for seven critical UniFi OS vulnerabilities—including a CVSS 10.0 command injection (CVE-2026-50746) and several CVSS 9.x flaws affecting UniFi Connect, Talk, Access, and Protect—that can enable command execution, SQL injection, SSRF, CORS abuse, and privilege escalation; organizations should apply the fixes in Security Advisory Bulletin 066 immediately. CISA has added related UniFi OS issues to its Known Exploited Vulnerabilities catalog, although Ubiquiti has not confirmed active exploitation.