This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Ubiquiti UniFi fixes 25 vulnerabilities in various products

Ubiquiti fixes 25 vulnerabilities in various UniFi products [1]; the critical vulnerabilities are described below. Individual products and their fixed versions [1]: UniFi Connect Application - 3.4.20 UniFi Talk Application - 5.2.2 UniFi Access Application - 4.2.29 UniFi OS - 5.1.19 (a list of the specific affected devices is available at [1]) UniFi Network Application - 10.4.57 UniFi Protect Application - 7.1.83 UniFi Protect Floodlight - 1.13.6

UniFi Connect Application - command injection (CVE-2026-50746)
CVSS 10.0 (Critical)

Allows an unauthenticated remote attacker to execute commands on the device in UniFi Connect Application due to insufficient access control [1].

The vulnerability is present in product:

  • UniFi Connect Application; <3.4.20;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 2. 7. 2026.

UniFi Talk Application - privilege escalation (CVE-2026-50747)
CVSS 9.9 (Critical)

Allows an authenticated remote attacker to escalate their privileges in UniFi Talk Application by means of an SQL injection attack [1].

The vulnerability is present in product:

  • UniFi Talk Application; <5.1.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2026-50747 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 2. 7. 2026.

UniFi Access Application - command injection (CVE-2026-50748)
CVSS 9.9 (Critical)

Allows an authenticated remote attacker to execute commands in UniFi Access Application due to insufficient input validation [1].

The vulnerability is present in product:

  • UniFi Access Application; <4.2.29;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 2. 7. 2026.

UniFi OS - command injection (CVE-2026-54402)
CVSS 9.9 (Critical)

Allows an authenticated remote attacker to execute commands on the device in UniFi OS due to insufficient input validation [1].

The vulnerability is present in product:

  • UniFi OS; <5.1.19;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 2. 7. 2026.

UniFi Protect Application - privilege escalation (CVE-2026-55115)
CVSS 9.9 (Critical)

Allows an authenticated remote attacker to escalate their privileges in UniFi Protect Application by carrying out an SSRF attack [1].

The vulnerability is present in product:

  • UniFi Protect Application; <7.1.83;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 2. 7. 2026.

By CESNET, z.s.p.o. Martin Krajči on 10. 7. 2026.

CESNET, z.s.p.o. Logo