UniFi hit by 25 flaws at once: cameras, door locks and routers

Update (July 2, 2026): Bulletin 066 lands 25 flaws across UniFi at once — cameras, door locks, and routers

On July 2, 2026, Ubiquiti published its official advisory "Bulletin 066," disclosing 25 vulnerabilities spanning nearly the whole UniFi brand at once. It is not just the routers and gateways at the heart of the network (UniFi OS). The list reaches security-camera management (UniFi Protect) and its outdoor lighting hardware (UniFi Protect Floodlight), the door and office access control that governs entry (UniFi Access), the network-management software (UniFi Network), IP phones (UniFi Talk), and store signage integration (UniFi Connect). The worst single flaw is CVE-2026-50746, whose CVSS (the Common Vulnerability Scoring System, a 0–10 measure of severity) is a perfect 10.0: an attacker can push arbitrary commands to the device with no login at all.

Of the 25, seven score CVSS 9.0 or above (critical) and the other 18 are high. Several need no login (unauthenticated) to exploit, and the rest use "a low-privileged user who can reach the network" as a foothold to take over the device or steal data. One relief is that Ubiquiti has a fix for all 25. But the holes disclosed earlier (Bulletin 064/065, covered below) are already on the US CISA's list of vulnerabilities exploited in real attacks (KEV) and are being targeted right now. UniFi is very much in attackers' sights, so treat these 25 on a "once it's public, it's fast" footing.

An attacker who can reach the management interface over the network — anyone in the world if the interface is exposed to the internet, or an insider who slips onto the office LAN or a store's free Wi-Fi — can hit some of these 25 with no login. No username or password required.

And it is not only the network's front door at stake. An attacker may be able to peek at security-camera footage, or reach into access control to touch unlock records and door operation. Because UniFi bundles networking, video, and physical security into one system, a takeover puts far more at risk.

For the people who use these services, it means camera footage, communications, and entry logs for a home or office can end up in someone else's hands. For the companies that run them, it means losing trust in the network backbone and the physical security setup at the same time. Fixes are in "What to do about these 25 right now" just below, and in the shared mitigations later in this article.

Here are the 25 flaws in Bulletin 066, grouped by product and ordered by CVSS. Rows where authentication is "None" are the ones exploitable without a login, so watch those most closely. "Cond." marks the ones where the advisory assumes a specific precondition, such as luring a logged-in user to a malicious page.

CVE-2026-50746: UniFi Connect, takeover with no authentication (CVSS 10.0)

UniFi Connect is the app that runs store and office digital signage (electronic display boards) and TV screens under UniFi's management. A weak input check here lets an attacker run arbitrary commands with no login at all. It is command injection (slipping unexpected commands into the device so it runs them) and the only perfect 10.0 among the 25. The fix is 3.24.20; version 3.24.16 and earlier are affected.

UniFi OS (the router/gateway core): six flaws

UniFi OS is the base software that runs the network's central devices — Dream Machine, Cloud Gateway, Enterprise Fortress Gateway, and more. There are six here: low-privilege command injection (CVE-2026-54402, CVSS 9.9), an unauthenticated access-control flaw that lets settings be rewritten (CVE-2026-55116, 9.0), SQL injection to privilege escalation (CVE-2026-54404), an unauthenticated path traversal that bypasses login (CVE-2026-54403), a low-privilege SSRF that escalates privileges (CVE-2026-54401, 7.7), and a CORS misconfiguration that lets an attacker lure a logged-in admin to a malicious page and act in their session (CVE-2026-55110, 7.5). A seventh, CVE-2026-55112 (7.5), applies to UniFi OS running alongside UniFi Protect and seizes host privileges. The fix for all is UniFi OS 5.1.19 or later. Even devices you updated for Bulletin 064/065 need to be bumped once more.

UniFi Protect (camera management): five flaws, plus one in the Floodlight

UniFi Protect is the app for recording and viewing security-camera footage. An unauthenticated API authentication bypass (CVE-2026-54407) and a video-stream authentication bypass (CVE-2026-54408) both open a door for someone not logged in to reach footage or features. On top of that are a low-privilege SSRF that pivots through the server (CVE-2026-55115, CVSS 9.9), SQL injection (CVE-2026-56841), and an improper-initialization bug that bypasses authentication on the cameras themselves under certain conditions (CVE-2026-54409, 7.5). The fix is 7.1.83 or later. A camera installed for security turning into a peephole is what makes this group so serious.

Easy to miss is the UniFi Protect Floodlight, separate hardware from the cameras. An unauthenticated path traversal reads files off the device (CVE-2026-55111, 7.5), fixed in 1.13.6 or later. Updating the Protect application does not update this light's firmware — that is a separate job.

UniFi Access (entry control): three flaws

UniFi Access electronically manages office doors and building entry. Alongside low-privilege command injection (CVE-2026-50748, CVSS 9.9) and a high-privilege abuse leading to privilege escalation (CVE-2026-54400, 9.1), an unauthenticated path traversal can read files on the device (CVE-2026-55117). When a software hole opens in a physical lock system, the worries are theft of unlock records and knock-on effects on door control. The fix is 4.2.29 or later.

UniFi Network: five flaws; UniFi Talk: three

The UniFi Network Application (network management) has five: two low-privilege escalations (CVE-2026-55114, 8.8 and CVE-2026-55118, 8.3), a path traversal on self-hosted instances that seizes write access (CVE-2026-54406, 8.7), an unauthenticated denial of service (CVE-2026-54405, 7.5), and an authorization bug where a user keeps their privileges after those privileges have been revoked (CVE-2026-56842, 7.5) — the kind of thing that quietly leaves a departed employee with access. The fix is 10.4.57 or later.

The IP-phone service UniFi Talk has three: a low-privilege SQL injection leading to privilege escalation (CVE-2026-50747, CVSS 9.9), a low-privilege access-control flaw (CVE-2026-55119, 8.1), and an unauthenticated SSRF that causes denial of service and bypasses authentication on some API endpoints (CVE-2026-55113, 7.5). The fix is 5.2.2 or later.

Fixed-version quick reference (Bulletin 066)

The version to fix on differs per product this time. Two columns below: the minimum the advisory requires, and the latest release shipping as of late July 2026. Meeting the first closes all 25; Ubiquiti has kept shipping updates since, so in practice aim for the second.

The minimum fixed versions the advisory names have not moved since July 2. What has moved are the regular releases on top of them — UniFi Network Application 10.5.67, UniFi Protect 7.1.87, and UniFi OS 5.1.26. Exact versions are updated on the official advisory (Bulletin 066).

What to do about these 25 right now

The earlier timeline — three CVSS 10.0 flaws in May's Bulletin 064, five more in June's Bulletin 065, and three of those confirmed by CISA as "exploited in the wild" — continues below. What UniFi is, what happens when it is taken over, and the shared mitigations are all explained in the sections that follow.

Update (June 23, 2026): CISA confirms active exploitation; an unauthenticated root-takeover chain goes public

There is a major follow-up to the three flaws disclosed in May (CVE-2026-34908 / 34909 / 34910, all at the maximum CVSS 10.0). On June 23, 2026, the US agency CISA added them to its list of vulnerabilities known to be exploited in real attacks (KEV). On top of that, security firm Bishop Fox published both the full attack sequence — chaining the three to seize the device's highest privilege (root, full control beyond admin) with no login — and a free tool to check whether you are affected. Treat this as a step up from "dangerous in theory" to "actively being targeted."

KEV (Known Exploited Vulnerabilities) is the official list, maintained by the US Cybersecurity and Infrastructure Security Agency (CISA), of flaws confirmed used in real attacks. A listing means the issue is escalated to "patch now," on the assumption that attackers are already using the hole. You can also search the listing status on the CISA KEV dashboard.

Be precise about what the exploitation is. What has been observed is Mirai-family IoT botnets taking over exposed UniFi devices and enrolling them into their own attack network. The Stack states plainly that these CVEs have not been flagged as used in ransomware campaigns, and no victim organizations have been named. That is not a reason to relax: a device pulled into a botnet becomes a launchpad for DDoS attacks on others, and the same entry path stays open for a deeper intrusion later.

Any attacker who can reach the device's IP address over the network can launch this chain without any login ID or password. If the management interface is exposed to the internet, it can be targeted by anyone in the world.

What the attacker does here is seize the device's highest privilege (root) and take over the very core of the network. Once root is taken, the secrets stored on the device become visible, forged admin sessions that survive patching can be created, and in deployments where UniFi also runs cameras and door access, even physical equipment can be operated.

End users have all their corporate or home traffic watched, and the operating organization loses trust in its network foundation itself. The especially nasty part: patching alone does not evict an attacker who is already in (as below, you also need to rotate secrets).

How the "three-stage chain" reaches root without authentication

According to Bishop Fox's analysis, the attack flows as follows. First, CVE-2026-34908 (improper access control) and CVE-2026-34909 (path traversal) bypass login authentication and reach underlying files and accounts. Then CVE-2026-34910 (command injection) makes the device run arbitrary commands and seizes the highest privilege.

At the root of it is an interpretation mismatch: the component that decides authentication looks at the "raw URL (raw URI)," while the internal web server (nginx) routes based on the "normalized URL." Furthermore, the injected commands run under a high-privilege service account that can perform some system operations without a password, making escalation to root easy. Bishop Fox says it confirmed it could obtain a root shell on a 5.0.6 instance with no credentials.

What to do right now

The response is two-stage: "update" plus "cleanup." Patching is not the end of it.

The affected versions and fixes for the three now-KEV-listed flaws are as follows.

Exact versions per model are kept up to date in the official advisory (Bulletin 064). Note that the separate five flaws disclosed in June's Bulletin 065 (below) are not KEV-listed as of this writing. Below, we walk through the five flaws first disclosed, the June follow-up, and the mitigations common to all of them.

Networking gear maker Ubiquiti has disclosed five vulnerabilities in its "UniFi OS". Three of them carry the maximum CVSS score of 10.0, and the other two land at 7.7 and 9.1 — extremely severe across the board. Without any login, attackers can hijack the routers and access points that sit in the middle of corporate and home networks.

UniFi is a series of business / SOHO networking products from Ubiquiti, Inc. According to Ubiquiti Japan (UI Japan)'s official note, the appeal is "no licensing fees" and "all-in-one management" — routers, switches, wireless APs, and surveillance cameras all run from a single dashboard. In Japan, Sonet Corporation is the official distributor, with SIers such as Hirano Tsushin Kizai and Amiya handling sales — and the brand is firmly established among cost-conscious SMBs, startups, cafes, and coworking spaces.

The issues are disclosed in official advisory "Bulletin 064", dated May 21, 2026. The fact that three of them — CVE-2026-34908, 34909, and 34910 — are all CVSS 10.0 with no authentication required shows how thoroughly UniFi OS's security guardrails have collapsed.

June 2026 update: Bulletin 065 adds five more, three of them requiring low privileges

On June 10, 2026, Ubiquiti published a follow-up advisory, "Bulletin 065", disclosing five new vulnerabilities in UniFi OS and the "UID Enterprise Agent," the resident software behind Ubiquiti's enterprise identity platform. Where May's Bulletin 064 was "CVSS 10.0 with no login required," three of these five now require a low-privileged user who can reach the device over the network — but in exchange they bring high-risk classes like command injection (forcing the device to run arbitrary commands) and privilege escalation. The remaining two need no authentication. Even devices already patched for 064 must be raised once more to the 065 fixed releases.

The original version of this table left out CVE-2026-48610 and wrongly listed CVE-2026-47367 as a UniFi OS flaw. 47367 is a UID Enterprise Agent bug, and no amount of UniFi OS patching closes it. If you run UID, update the agent to 1.61.4 or later as a separate task.

CVE-2026-34908 (CVSS 10.0): unauthenticated system modification

An improper access control flaw lets an attacker on the network change system settings without any login. With no credentials required and a perfect 10.0 score, this is the headline flaw of Bulletin 064 and the one to patch first.

CVE-2026-34909 (CVSS 10.0): path traversal to account takeover

A path traversal weakness lets an unauthenticated attacker read files they should never reach, including the data needed to hijack an administrator account. Reading the wrong file here ends in full account takeover.

CVE-2026-34910 (CVSS 10.0): command injection to remote code execution

Command injection without authentication means an attacker can run their own commands on the device over the network. This is the cleanest path from "on the same network" to "running code on your router."

CVE-2026-33000 (CVSS 9.1): command injection requiring admin rights

This command injection flaw needs high (administrator) privileges first, so it matters most as a way to deepen an existing foothold or for a rogue insider, rather than as a first-strike entry point.

CVE-2026-34911 (CVSS 7.7): path traversal with low privileges

A low-privileged user can use this path traversal flaw to reach restricted files. It is the least severe of the five, but combined with the others it widens what a limited account can see.

CVE-2026-47369 (CVSS 9.9): a low-privileged user seizes admin rights

An improper input validation flaw lets a low-privileged user who can reach the device escalate to higher privileges inside UniFi OS. The danger is that an ordinary employee account — or anyone who can touch the device via a guest network — can reach administrator-level operations.

CVE-2026-47370 (CVSS 9.9): command injection from low privileges

This flaw lets a low-privileged attacker push arbitrary commands into a device running UniFi OS. Command injection is the gateway to taking over the device itself — the same lethal class as 064's CVE-2026-34910. The only saving grace this time is that it requires low privileges rather than no authentication.

CVE-2026-47367 (CVSS 9.9): command injection in the UID Enterprise Agent

The UID Enterprise Agent is the resident software that runs Ubiquiti's enterprise identity platform "UID" on the host side. Abusing its input-validation gap allows arbitrary command execution on the host running the agent. This is an agent-side flaw, not a UniFi OS one: the fix is UID Enterprise Agent 1.61.4 or later, with 1.61.3 and earlier affected. Moving UniFi OS to 5.1.15+ leaves this one open, so organizations using UID must treat the agent update as its own task.

CVE-2026-47368 (CVSS 8.6): unauthenticated data theft from the device

This is one of the two in the set that needs no authentication. Via path traversal (walking back up the path to reach files that should be off-limits), anyone who can reach the device over the network can read data out of it. But it cannot alter or destroy anything — the impact is limited to data exfiltration, which is why it lands at 8.6. Compared with 064's CVE-2026-34909 (the same path traversal at 10.0, which reached "grab a file, then take over the account"), the impact stops one step short. The advisory does note that this one can be chained with other flaws to remove even the low-privilege requirement.

CVE-2026-48610 (CVSS 8.1): unauthenticated configuration changes

This is the flaw the original article missed. An improper access control issue lets an attacker who can reach the device over the network make unauthorized changes to a UniFi OS device with no login, under certain network configurations. That precondition raises attack complexity and holds the score to 8.1, but "no credentials needed" puts it in the same family as the 10.0 trio from 064. Scope is limited to the gateway and routing hardware — UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCG-Ultra, UCG-Max, UCG-Industrial, UCG-Fiber (5.1.12 and earlier) and UDM-Beast (5.1.11 and earlier) — and the fix is 5.1.15 or later.

On the UniFi OS side, affected versions span a wide range of 5.1.12 and earlier models (UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDR, UDR7, UCK, UCKP, the UNVR series, UCG-Ultra, UCG-Max, and more), plus UniFi OS Server 5.0.8 and earlier, UDM-Beast 5.1.11 and earlier, and the UNAS models at 5.1.10 and earlier. Fixed releases are UniFi OS 5.1.15 or later — but UNAS devices need 5.1.16+ and UniFi Express needs 4.0.15+. Remembering only "5.1.15" leaves those two behind. Even if you updated for 064, confirm your current version in the dashboard. As of this writing, none of these five has confirmed in-the-wild exploitation or a CISA KEV listing — this is a "second round" that ranks one notch below May's 10.0-class flaws. The update steps and interim mitigations in the "Affected products and fixes" and "Interim mitigations" sections below apply unchanged.

What UniFi is

UniFi is a package that covers your company's entire network with hardware from a single vendor. Key products that run on the same management surface (UniFi OS) include:

Headliners are the UniFi Dream Machine (UDM) all-in-one gateway, the UniFi Cloud Key small management server, the UniFi OS Console management appliance, various UniFi Switch models, and UniFi Access Point (AP) radios. Seeing all of them from a single pane of glass is the "UniFi way", and it has earned a reputation as easy to operate even in small offices without a dedicated IT staffer.

In Japan, as the Zenn article billing it as "the optimal answer for small venture office networks" shows, many engineers also deploy UniFi at home or in their own startup office. For roughly 50,000–100,000 yen, you get an "enterprise-flavored" network — a price point that also resonates with tech-leaning individual users.

And UniFi OS is the software in the middle of your network. Every internal communication passes through it. Hijack it, and everything beneath becomes visible to the attacker — that is the essence of today's vulnerabilities.

The five vulnerabilities

The disclosures in Bulletin 064 are:

The first three (CVSS 10.0) share a common condition: "network reachability is enough — no authentication needed". Having a UniFi management port simply sitting on the corporate network is sufficient for the attack to land. In particular, CVE-2026-34910 — a command injection — is a critical-class flaw that lets an attacker run arbitrary commands on the UniFi device itself.

What happens when the attack succeeds

A hijacked UniFi OS hands the attacker control of the entire network below. Concrete scenarios:

The hard part is that network device compromises are hard to notice. PC malware trips antivirus, but an attacker quietly intercepting traffic inside a router or switch is essentially invisible from the endpoints. Cases of "we just realized our internal communications had been siphoned for six months" are entirely plausible in this category.

Home users running UniFi are in the same boat. Family PCs, smartphones, and smart home devices — all their traffic becomes visible to the attacker. Tech-loving individual users cannot consider this someone else's problem.

Affected products and fixes

The advisory covers any product running "UniFi OS". UniFi OS is the common platform underneath Ubiquiti's management appliances, and runs on the following representative products:

The remediation is straightforward: update UniFi OS to the latest version. Use one of the following paths:

If automatic updates are enabled, the new firmware may already be deployed. Verify that the "UniFi OS Version" shown on the dashboard is at or above the fixed version listed in Bulletin 064. Specific version numbers are updated on Ubiquiti's official advisory page.

Interim mitigations to apply at minimum

Until the patch is applied — and for longer-term risk reduction — the following settings are recommended:

The WAN-side dashboard exposure in particular has been a recurring root cause of UniFi compromises in the past. If you don't know who turned on "Allow Remote Access" or when, turning it off is the right move until you do.

Ubiquiti has been a target before

Thanks to their value-for-money pricing and broad install base, Ubiquiti products have long been an appealing target for attackers.

In 2021, a major credential exposure incident around the UniFi Cloud functionality led Ubiquiti to urge customers to change their passwords. From 2022 onward, high-severity flaws have surfaced intermittently in UniFi Dream Machine, UniFi Protect (camera management), and the UniFi Network Application. Even earlier in 2026, before today's batch, CVE-2026-22557 (path traversal) and CVE-2026-22558 (privilege escalation) were already on the books.

This is not "Ubiquiti is uniquely buggy". It should be read as a problem common to the entire network device category. Vulnerabilities in Cisco, Fortinet, Pulse Secure, and similar products have become primary entry vectors for APT (nation-state) and ransomware groups in recent years. The attacker's gaze rests on home, SOHO, and mid-market networks alike.

Conversely, a vendor publishing advisories on a regular cadence is a healthy state of affairs. The real question is whether the user side has the awareness and operational muscle to act on those advisories quickly.

Closing thoughts

Three CVSS 10.0 vulnerabilities in a single advisory, all exploitable remotely without authentication, is about as bad a package as a networking-gear security disclosure can get. Ubiquiti has done its part by publishing Bulletin 064 clearly, but if user-side updates do not catch up, this lines up directly with real-world compromises.

Teams operating UniFi in small offices, and engineers running UniFi at home — log in to the dashboard now and check your version. Even if you have automatic updates enabled, visually confirming that the patch landed is worthwhile. "UniFi: set it and forget it" is the selling point, which is exactly why undoing the "forget" is a job for tonight.

References

• ▸ Ubiquiti Community - Security Advisory Bulletin 066 (July 2, 2026, 25 new flaws)
• ▸ Cyber Security News - Ubiquiti Disclosed 25 Security Vulnerabilities Across the UniFi Ecosystem
• ▸ SecurityOnline - UniFi Security Advisory 066 (7 critical, 18 high)
• ▸ The Stack - Ubiquiti UniFi OS vulnerabilities exploited in the wild (not flagged for ransomware use)
• ▸ Tech Times - UniFi CVSS 10.0 Flaw Exposes 100,000 Endpoints (Censys exposure data)
• ▸ NVD - CVE-2026-50746 (UniFi Connect, unauthenticated command injection, CVSS 10.0)
• ▸ CISA - Known Exploited Vulnerabilities Catalog (KEV)
• ▸ Bishop Fox - Popping Root on UniFi OS Server: Unauthenticated RCE Chain
• ▸ GitHub - BishopFox/CVE-2026-34908-check (free detection script)
• ▸ BleepingComputer - Critical UniFi OS bug lets hackers gain root without authentication
• ▸ Ubiquiti Community - Security Advisory Bulletin 064
• ▸ Ubiquiti Community - Security Advisory Bulletin 065 (June 10, 2026, 5 flaws)
• ▸ NVD - CVE-2026-47369 (privilege escalation, CVSS 9.9)
• ▸ NVD - CVE-2026-47370 (command injection, CVSS 9.9)
• ▸ NVD - CVE-2026-47367 (UID Enterprise Agent, CVSS 9.9)
• ▸ NVD - CVE-2026-47368 (path traversal, CVSS 8.6)
• ▸ NVD - CVE-2026-48610 (improper access control, CVSS 8.1)
• ▸ NVD - CVE-2026-34908 (Improper access control, CVSS 10.0)
• ▸ NVD - CVE-2026-34909 (Path traversal, CVSS 10.0)
• ▸ NVD - CVE-2026-34910 (Command injection, CVSS 10.0)
• ▸ NVD - CVE-2026-33000 (Command injection, CVSS 9.1)
• ▸ NVD - CVE-2026-34911 (Path traversal, CVSS 7.7)
• ▸ Ubiquiti Japan - What is UniFi? (deep dive)
• ▸ Ubiquiti Japan official site