Ubiquiti Patches Critical UniFi Vulnerabilities
NEOSEC enrichment — no mirror of the original source
Ubiquiti has released updates to address seven critical vulnerabilities in UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS. CVE-2026-50746, CVSS score 10.0, is an improper access control issue in UniFi Connect Applicati
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Honan, Neely.
Linked advisories
- CVE-2026-50748ui unifi_access: unzureichende Eingabevalidierung
- CVE-2026-55115ui unifi_protect: Server-Side-Request-Forgery (SSRF)
- CVE-2026-50748ui unifi_access: unzureichende Eingabevalidierung
- CVE-2026-34908Ubiquiti UniFi OS Server: Mehrere Schwachstellen
- CVE-2026-54400ui unifi_access: unzureichende Zugriffskontrolle
- CVE-2026-34908ui enterprise_fortress_gateway_firmware: unzureichende Zugriffskontrolle
- CVE-2026-55116ui unifi_connect: unzureichende Zugriffskontrolle
- CVE-2026-55115ui unifi_protect: Server-Side-Request-Forgery (SSRF)
- CVE-2026-54402ui enterprise_firewall_core_firmware: unzureichende Eingabevalidierung
- CVE-2026-50746ui unifi_connect_application: unzureichende Zugriffskontrolle
- CVE-2026-54400ui unifi_access: unzureichende Zugriffskontrolle
- CVE-2026-34909A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system …
- CVE-2026-55115Ubiquiti UniFi: Mehrere Schwachstellen
- CVE-2026-34909Ubiquiti UniFi OS — Ubiquiti UniFi OS Path Traversal Vulnerability
- CVE-2026-54402ui enterprise_firewall_core_firmware: unzureichende Eingabevalidierung
- CVE-2026-50747ui unifi_talk_application: SQL-Injection
- CVE-2026-34910Ubiquiti UniFi OS — Ubiquiti UniFi OS Improper Input Validation Vulnerability
- CVE-2026-34910ui enterprise_fortress_gateway_firmware: unzureichende Eingabevalidierung
- CVE-2026-34908A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to…
- CVE-2026-50747ui unifi_talk_application: SQL-Injection
- CVE-2026-55116ui unifi_connect: unzureichende Zugriffskontrolle
- CVE-2026-34908Ubiquiti UniFi OS — Ubiquiti UniFi OS Improper Access Control Vulnerability
- CVE-2026-34910A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
- CVE-2026-50746ui unifi_connect_application: unzureichende Zugriffskontrolle
- CVE-2026-34909Ubiquiti UniFi OS: Pfadüberschreitung (Path Traversal)
Affected vendors and products
- Ubiquiti Inc Cloud Gateways
- Ubiquiti Inc Cloud Keys
- Ubiquiti Inc Dream Machines
- Ubiquiti Inc Dream Routers
- Ubiquiti Inc Dream Wall
- Ubiquiti Inc Enterprise Firewall Core
- Ubiquiti Inc Enterprise Fortress Gateway
- Ubiquiti Inc Enterprise Video Recorders
- Ubiquiti Inc Express 7
- Ubiquiti Inc Network Attached Storage
- Ubiquiti Inc Network Video Recorders
- Ubiquiti Inc Unifi Access Application
More on UniFi
Other advisories
- HighCVE-2026-76506Cisco Unified Computing System (UCS): Schwachstelle ermöglicht Codeausführung
- MediumCVE-2026-76419Cisco Unified Communications Manager (CUCM): Schwachstelle ermöglicht Cross-Site Scripting
- MediumCVE-2026-76419Cisco Unified Communications Manager: Cross-Site-Scripting (XSS)
- MediumCVE-2026-76419Cisco Unified Communications Manager: Cross-Site-Scripting (XSS)
- HighCVE-2026-76506Cisco Unified Computing System Central Software: Pfadüberschreitung (Path Traversal)
- HighCVE-2026-76506Cisco Unified Computing System Central Software: Pfadüberschreitung (Path Traversal)
- Not ratedosv:CLEANSTART-2026-AW65525Hazelcast is a unified real-time data platform combining stream processing with a fast data store
- Not ratedosv:CLEANSTART-2026-NN87055Hazelcast is a unified real-time data platform combining stream processing with a fast data store
Other news entries
- Cisco Unified Computing System (UCS): Schwachstelle ermöglicht CodeausführungVulnerabilityBSI CERT-Bund
- Cisco Unified Communications Manager (CUCM): Schwachstelle ermöglicht Cross-Site ScriptingVulnerabilityBSI CERT-Bund
- Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityNewsCisco PSIRT
- Sophos Unified Threat Management (UTM) Software: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenVulnerabilityBSI CERT-Bund
- Cisco Unified Communications Products Security Hardening Release: October 2026NewsCisco PSIRT
- BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing RevocationsNewsThe Hacker News
- AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security StackNewsDark Reading
- Cisco Produkte (Emergency Responder, Prime Collaboration, Unified Communications Manager und Unity Connection): Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
ID