Ubiquiti warns of new max severity UniFi OS vulnerability

Ubiquiti released patches addressing seven critical UniFi OS vulnerabilities — including a maximum-severity command-injection (CVE-2026-50746) affecting UniFi Connect and six additional critical flaws across UniFi apps and devices. Censys reports over 100,000 internet-exposed UniFi OS instances, many in the U.S.; several flaws are low-complexity and chainable to achieve remote code execution. Given prior exploitation of Ubiquiti products by state-sponsored and criminal groups, the report urges immediate updates to mitigate widespread exposure.