Loading vulnerability…
Command Injection in Ubiquiti UniFi Connect Application
CVE-2026-50746 is a critical improper access control vulnerability in Ubiquiti UniFi Connect Application affecting version 3.4.16 and earlier. The flaw allows a malicious actor with network access to reach insufficiently protected functionality in the application and trigger command injection on the underlying host device. Available reporting indicates the issue stems from inadequate authorization controls on exposed application endpoints involved in device-management operations, enabling an attacker to execute arbitrary system commands without requiring user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in arbitrary command execution on the host device running UniFi Connect. This can enable full compromise of the affected system, including unauthorized access to data, modification of system state or configuration, service disruption, and potential follow-on actions such as persistence or lateral movement depending on the host's role and privileges.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network access to UniFi Connect management interfaces and exposed application endpoints to only trusted administrative networks and hosts. Review and tighten access control policies around the application, minimize network adjacency to the service, and monitor for unexpected command execution or anomalous administrative activity. Information currently available indicates no interim workaround is provided, so these measures only reduce exposure until the fixed version is deployed.
Patch, then assume compromise.
Upgrade UniFi Connect Application to version 3.4.20 or later. Apply the vendor-provided security updates across affected UniFi deployments and verify that all instances running version 3.4.16 and earlier are removed from service or updated. Because no alternative fix is described, patching to a fixed release should be treated as the primary remediation.
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.