Vendor

Ubiquiti

Vulnerabilities in Ubiquiti's UniFi product line — the switches, gateways, and access points that make up the physical layer of a lot of small businesses, campuses, and prosumer networks, often deployed once and rarely touched again.

CVEs

CVE-2026-50746

[ CRITICAL ] CVSS 10.0 patched

Ubiquiti UniFi Connect command injection (Bulletin 066)

Improper access control in Ubiquiti UniFi Connect ≤3.4.16 lets an attacker with network access execute command injection on the host device. CVSS 10.0. Fixed in 3.4.20.

Ubiquiti / UniFi Connect (3.4.16 and earlier) Jul 8

Articles

~/articles/2026-07-08-ubiquiti-unifi-connect-command-injection-cve-2026-50746

ubiquiti

Ubiquiti Patches Max-Severity UniFi Connect Command Injection

Ubiquiti Bulletin 066 patches seven critical UniFi flaws, headlined by a CVSS 10.0 command injection in UniFi Connect 3.4.16 and earlier. Fix: 3.4.20 or later.

Jul 8 read →