Loading vulnerability…
Command Injection in UniFi Access Application
CVE-2026-50748 is a critical improper input validation vulnerability in the Ubiquiti UniFi Access Application. The flaw allows a malicious actor with network access and low privileges to supply crafted input that is not properly validated, resulting in command injection on the underlying host device. The issue affects UniFi Access Application version 4.2.28 and earlier and is fixed in version 4.2.29. The vulnerability is remotely exploitable, requires no user interaction, and can lead directly to execution of attacker-controlled commands in the host environment.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can give an attacker the ability to execute arbitrary commands on the host device running UniFi Access. This can result in full compromise of the affected system, including loss of confidentiality, integrity, and availability. An attacker may be able to run follow-on actions such as modifying configuration, accessing sensitive data, disrupting services, establishing persistence, or using the compromised device as a pivot within the local environment.
If you can’t patch tonight, do this now.
Restrict network access to the UniFi Access management interface and host device to only trusted administrative networks and users. Minimize the number of low-privileged accounts, review and harden role assignments, and monitor the system for suspicious command execution or unexpected configuration changes. These measures may reduce exposure but do not replace upgrading to a fixed release.
Patch, then assume compromise.
Upgrade UniFi Access Application to version 4.2.29 or later. After applying the update, verify the integrity and configuration state of the affected system to ensure no unauthorized changes or persistence mechanisms were introduced prior to patching. Because no reliable interim workaround is documented, vendor-provided updates should be treated as the primary remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.