Ubiquiti UniFi Connect command injection (Bulletin 066)
Improper access control in Ubiquiti UniFi Connect ≤3.4.16 lets an attacker with network access execute command injection on the host device. CVSS 10.0. Fixed in 3.4.20.
- Vendor
- Ubiquiti
- Product
- UniFi Connect (3.4.16 and earlier)
- CVSS
- 10.0
- EPSS (exploit probability)
- 1.7%
- Status
- patched
- Published
Is CVE-2026-50746 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-50746 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-21 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.7% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-50746 is the max-severity item in Ubiquiti’s Security Advisory Bulletin 066: an improper access control in UniFi Connect that permits command injection on the host device by an actor with network access to the appliance. NVD rates it CVSS 10.0 critical.
Affected
- Ubiquiti UniFi Connect — versions 3.4.16 and earlier.
Patched
- UniFi Connect 3.4.20 or later.
Exploitation status
- No confirmed in-the-wild exploitation as of publication; Ubiquiti “has yet to disclose whether any of these vulnerabilities were exploited in the wild,” per BleepingComputer.
- No public proof-of-concept posted.
- Not on CISA KEV at time of publication.
Companion CVEs in Bulletin 066
The same bulletin covers six additional critical vulnerabilities across UniFi OS, UniFi Access, and adjacent applications:
- CVE-2026-50747 — CVSS 9.9.
- CVE-2026-50748 — CVSS 9.9.
- CVE-2026-54400 — CVSS 9.1 (UniFi Access, privilege escalation requiring high existing privileges).
- CVE-2026-54402 — CVSS 9.9.
- CVE-2026-55115 — CVSS 9.9.
- CVE-2026-55116 — CVSS 9.0 (UniFi OS, unauthorized changes gated by certain network configurations).
Sourcing
- NVD: CVE-2026-50746
- Vendor advisory: Ubiquiti Security Advisory Bulletin 066
- BleepingComputer: Ubiquiti warns of new max severity UniFi OS vulnerability
Other Ubiquiti CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-77554 UniFi Talk command injection — unauthenticated remote code executionwrite-up | [ CRITICAL ] | 10.0 | 1.6% | — |
| CVE-2026-77550 UniFi OS CRLF injection — authentication bypasswrite-up | [ CRITICAL ] | 10.0 | 0.8% | — |
| CVE-2026-77537 UniFi Protect Application improper input validation — unauthenticated RCEwrite-up | [ CRITICAL ] | 10.0 | 1.6% | — |
| CVE-2026-54400 Ubiquiti UniFi Access improper access control (Bulletin 066)write-up | [ CRITICAL ] | 9.1 | 0.5% | — |
| CVE-2026-50748 Ubiquiti UniFi critical flaw (Bulletin 066)write-up | [ CRITICAL ] | 9.9 | 1.6% | — |
| CVE-2026-50747 Ubiquiti UniFi critical flaw (Bulletin 066)write-up | [ CRITICAL ] | 9.9 | 0.5% | — |
| CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation Vulnerability | [ CRITICAL ] | 10.0 | 45.8% | |
| CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability | [ CRITICAL ] | 10.0 | 1.8% |
