UniFi hit by 15 flaws at once: cameras, door locks, routers, CVE-2026-50746

Update (July 2, 2026): Bulletin 066 lands 15 flaws across UniFi at once — cameras, door locks, and routers

On July 2, 2026, Ubiquiti published its official advisory "Bulletin 066," disclosing 15 vulnerabilities spanning nearly the whole UniFi brand at once. It is not just the routers and gateways at the heart of the network (UniFi OS). The list reaches security-camera management (UniFi Protect), the door and office access control that governs entry (UniFi Access), the network-management software (UniFi Network), IP phones (UniFi Talk), and store signage integration (UniFi Connect). The worst single flaw is CVE-2026-50746, whose CVSS (the Common Vulnerability Scoring System, a 0–10 measure of severity) is a perfect 10.0: an attacker can push arbitrary commands to the device with no login at all.

Of the 15, 6 need no login (unauthenticated) to exploit, and the rest use "a low-privileged user who can reach the network" as a foothold to take over the device or steal data. One relief is that Ubiquiti has a fix for all 15. But the holes disclosed earlier (Bulletin 064/065, covered below) are already on the US CISA's list of vulnerabilities exploited in real attacks (KEV) and are being targeted right now. UniFi is very much in attackers' sights, so treat these 15 on a "once it's public, it's fast" footing.

An attacker who can reach the management interface over the network — anyone in the world if the interface is exposed to the internet, or an insider who slips onto the office LAN or a store's free Wi-Fi — can hit some of these 15 with no login. No username or password required.

And it is not only the network's front door at stake. An attacker may be able to peek at security-camera footage, or reach into access control to touch unlock records and door operation. Because UniFi bundles networking, video, and physical security into one system, a takeover puts far more at risk.

For the people who use these services, it means camera footage, communications, and entry logs for a home or office can end up in someone else's hands. For the companies that run them, it means losing trust in the network backbone and the physical security setup at the same time. Fixes are in "What to do about these 15 right now" just below, and in the shared mitigations later in this article.

Here are the 15 flaws in Bulletin 066, organized by product. Rows where authentication is "None" are the ones exploitable without a login, so watch those most closely.

CVE-2026-50746: UniFi Connect, takeover with no authentication (CVSS 10.0)

UniFi Connect is the app that runs store and office digital signage (electronic display boards) and TV screens under UniFi's management. A weak input check here lets an attacker run arbitrary commands with no login at all. It is command injection (slipping unexpected commands into the device so it runs them) and the only perfect 10.0 among the 15. The fix is 3.4.20; everything below it is affected.

UniFi OS (the router/gateway core): four flaws

UniFi OS is the base software that runs the network's central devices — Dream Machine, Cloud Gateway, Enterprise Fortress Gateway, and more. There are four here: low-privilege command injection (CVE-2026-54402, CVSS 9.9), an unauthenticated access-control flaw that lets settings be rewritten (CVE-2026-55116, 9.0), SQL injection to privilege escalation (CVE-2026-54404), and an unauthenticated path traversal that bypasses login (CVE-2026-54403). The fix for all is UniFi OS 5.1.19. Even devices you updated for Bulletin 064/065 need to be bumped once more to 5.1.19.

UniFi Protect (camera management): four flaws

UniFi Protect is the app for recording and viewing security-camera footage. An unauthenticated API authentication bypass (CVE-2026-54407) and a video-stream authentication bypass (CVE-2026-54408) both open a door for someone not logged in to reach footage or features. On top of that are a low-privilege SSRF that pivots through the server (CVE-2026-55115, CVSS 9.9) and SQL injection (CVE-2026-56841). The fix is 7.1.83. A camera installed for security turning into a peephole is what makes this group so serious.

UniFi Access (entry control): three flaws

UniFi Access electronically manages office doors and building entry. Alongside low-privilege command injection (CVE-2026-50748, CVSS 9.9) and a high-privilege abuse leading to privilege escalation (CVE-2026-54400, 9.1), an unauthenticated path traversal can read files on the device (CVE-2026-55117). When a software hole opens in a physical lock system, the worries are theft of unlock records and knock-on effects on door control. The fix is 4.2.29.

UniFi Network and Talk, too

The UniFi Network Application (network management) has two: low-privilege privilege escalation (CVE-2026-55114) and path traversal that seizes write access (CVE-2026-54406); the fix is 10.4.57. The IP-phone service UniFi Talk has a low-privilege SQL injection leading to privilege escalation (CVE-2026-50747, CVSS 9.9), fixed in 5.2.2.

Fixed-version quick reference (Bulletin 066)

The version to fix on differs per product this time. Check each UniFi product you run against the table below.

Exact versions are updated on the official advisory (Bulletin 066).

What to do about these 15 right now

The earlier timeline — three CVSS 10.0 flaws in May's Bulletin 064, four more in June's Bulletin 065, and three of those confirmed by CISA as "exploited in the wild" — continues below. What UniFi is, what happens when it is taken over, and the shared mitigations are all explained in the sections that follow.

Update (June 24, 2026): CISA confirms active exploitation; an unauthenticated root-takeover chain goes public

There is a major follow-up to the three flaws disclosed in May (CVE-2026-34908 / 34909 / 34910, all at the maximum CVSS 10.0). On June 24, 2026, the US agency CISA added them to its list of vulnerabilities known to be exploited in real attacks (KEV). On top of that, security firm Bishop Fox published both the full attack sequence — chaining the three to seize the device's highest privilege (root, full control beyond admin) with no login — and a free tool to check whether you are affected. Treat this as a step up from "dangerous in theory" to "actively being targeted."

KEV (Known Exploited Vulnerabilities) is the official list, maintained by the US Cybersecurity and Infrastructure Security Agency (CISA), of flaws confirmed used in real attacks. A listing means the issue is escalated to "patch now," on the assumption that attackers are already using the hole. You can also search the listing status on the CISA KEV dashboard.

Any attacker who can reach the device's IP address over the network can launch this chain without any login ID or password. If the management interface is exposed to the internet, it can be targeted by anyone in the world.

What the attacker does here is seize the device's highest privilege (root) and take over the very core of the network. Once root is taken, the secrets stored on the device become visible, forged admin sessions that survive patching can be created, and in deployments where UniFi also runs cameras and door access, even physical equipment can be operated.

End users have all their corporate or home traffic watched, and the operating organization loses trust in its network foundation itself. The especially nasty part: patching alone does not evict an attacker who is already in (as below, you also need to rotate secrets).

How the "three-stage chain" reaches root without authentication

According to Bishop Fox's analysis, the attack flows as follows. First, CVE-2026-34908 (improper access control) and CVE-2026-34909 (path traversal) bypass login authentication and reach underlying files and accounts. Then CVE-2026-34910 (command injection) makes the device run arbitrary commands and seizes the highest privilege.

At the root of it is an interpretation mismatch: the component that decides authentication looks at the "raw URL (raw URI)," while the internal web server (nginx) routes based on the "normalized URL." Furthermore, the injected commands run under a high-privilege service account that can perform some system operations without a password, making escalation to root easy. Bishop Fox says it confirmed it could obtain a root shell on a 5.0.6 instance with no credentials.

What to do right now

The response is two-stage: "update" plus "cleanup." Patching is not the end of it.

The affected versions and fixes for the three now-KEV-listed flaws are as follows.

Exact versions per model are kept up to date in the official advisory (Bulletin 064). Note that the separate four flaws disclosed in June's Bulletin 065 (below) are not KEV-listed as of this writing. Below, we walk through the five flaws first disclosed, the June follow-up, and the mitigations common to all of them.

Networking gear maker Ubiquiti has disclosed five vulnerabilities in its "UniFi OS". Three of them carry the maximum CVSS score of 10.0, and the other two land at 7.7 and 9.1 — extremely severe across the board. Without any login, attackers can hijack the routers and access points that sit in the middle of corporate and home networks.

UniFi is a series of business / SOHO networking products from Ubiquiti, Inc. According to Ubiquiti Japan (UI Japan)'s official note, the appeal is "no licensing fees" and "all-in-one management" — routers, switches, wireless APs, and surveillance cameras all run from a single dashboard. In Japan, Sonet Corporation is the official distributor, with SIers such as Hirano Tsushin Kizai and Amiya handling sales — and the brand is firmly established among cost-conscious SMBs, startups, cafes, and coworking spaces.

The issues are disclosed in official advisory "Bulletin 064", dated May 21, 2026. The fact that three of them — CVE-2026-34908, 34909, and 34910 — are all CVSS 10.0 with no authentication required shows just how comprehensively UniFi OS's security guardrails have collapsed.

June 2026 update: Bulletin 065 adds four more, this time requiring low privileges

On June 12, 2026, Ubiquiti published a follow-up advisory, "Bulletin 065", disclosing four new vulnerabilities in UniFi OS and the "UID Enterprise Agent" management software. Where May's Bulletin 064 was "CVSS 10.0 with no login required," three of these four now require a low-privileged user who can reach the device over the network — but in exchange they bring high-risk classes like command injection (forcing the device to run arbitrary commands) and privilege escalation. Even devices already patched for 064 must be raised once more to the 065 fixed releases.

CVE-2026-34908 (CVSS 10.0): unauthenticated system modification

An improper access control flaw lets an attacker on the network change system settings without any login. With no credentials required and a perfect 10.0 score, this is the headline flaw of Bulletin 064 and the one to patch first.

CVE-2026-34909 (CVSS 10.0): path traversal to account takeover

A path traversal weakness lets an unauthenticated attacker read files they should never reach, including the data needed to hijack an administrator account. Reading the wrong file here ends in full account takeover.

CVE-2026-34910 (CVSS 10.0): command injection to remote code execution

Command injection without authentication means an attacker can run their own commands on the device over the network. This is the cleanest path from "on the same network" to "running code on your router."

CVE-2026-33000 (CVSS 9.1): command injection requiring admin rights

This command injection flaw needs high (administrator) privileges first, so it matters most as a way to deepen an existing foothold or for a rogue insider, rather than as a first-strike entry point.

CVE-2026-34911 (CVSS 7.7): path traversal with low privileges

A low-privileged user can use this path traversal flaw to reach restricted files. It is the least severe of the five, but combined with the others it widens what a limited account can see.

CVE-2026-47369 (CVSS 9.9): a low-privileged user seizes admin rights

An improper input validation flaw lets a low-privileged user who can reach the device escalate to higher privileges inside UniFi OS. The danger is that an ordinary employee account — or anyone who can touch the device via a guest network — can reach administrator-level operations.

CVE-2026-47370 (CVSS 9.9): command injection from low privileges

This flaw lets a low-privileged attacker push arbitrary commands into a device running UniFi OS. Command injection is the gateway to taking over the device itself — the same lethal class as 064's CVE-2026-34910. The only saving grace this time is that it requires low privileges rather than no authentication.

CVE-2026-47367 (CVSS 9.9): command injection in the UID Enterprise Agent

The UID Enterprise Agent is the resident software that runs Ubiquiti's enterprise identity platform "UID" on the host side. Abusing its input-validation gap allows arbitrary command execution on the host running the agent. Organizations using UID must update this agent in addition to UniFi OS itself.

CVE-2026-47368 (CVSS 8.6): unauthenticated data theft from the device

This is the only one of the four that needs no authentication. Via path traversal (walking back up the path to reach files that should be off-limits), anyone who can reach the device over the network can read data out of it. But it cannot alter or destroy anything — the impact is limited to data exfiltration, which is why it lands at 8.6. Compared with 064's CVE-2026-34909 (the same path traversal at 10.0, which reached "grab a file, then take over the account"), the impact stops one step short.

Affected versions span a wide range of UniFi OS 5.1.12 and earlier models (UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDR, UDR7, UCK, UCKP, the UNVR series, UCG-Ultra, UCG-Max, and more), plus UniFi OS Server 5.0.08 and earlier and UDM-Beast 5.1.11 and earlier. Fixed releases are UniFi OS 5.1.15 or later (UNAS devices 5.1.16+, UniFi Express 4.0.15+). Even if you updated for 064, confirm in the dashboard that your current version is 5.1.15 or higher. As of this writing (June 12, 2026), none of these four has confirmed in-the-wild exploitation or a CISA KEV listing — this is a "second round" that ranks one notch below May's 10.0-class flaws. The update steps and interim mitigations in the "Affected products and fixes" and "Interim mitigations" sections below apply unchanged.

What UniFi is

UniFi is a package that covers your company's entire network with hardware from a single vendor. Key products that run on the same management surface (UniFi OS) include:

Headliners are the UniFi Dream Machine (UDM) all-in-one gateway, the UniFi Cloud Key small management server, the UniFi OS Console management appliance, various UniFi Switch models, and UniFi Access Point (AP) radios. Seeing all of them from a single pane of glass is the "UniFi way", and it has earned a reputation as easy to operate even in small offices without a dedicated IT staffer.

In Japan, as the Zenn article billing it as "the optimal answer for small venture office networks" shows, many engineers also deploy UniFi at home or in their own startup office. For roughly 50,000–100,000 yen, you get an "enterprise-flavored" network — a price point that also resonates with tech-leaning individual users.

And UniFi OS is the software in the middle of your network. Every internal communication passes through it. Hijack it, and everything beneath becomes visible to the attacker — that is the essence of today's vulnerabilities.

The five vulnerabilities

The disclosures in Bulletin 064 are:

The first three (CVSS 10.0) share a common condition: "network reachability is enough — no authentication needed". Having a UniFi management port simply sitting on the corporate network is sufficient for the attack to land. In particular, CVE-2026-34910 — a command injection — is a critical-class flaw that lets an attacker run arbitrary commands on the UniFi device itself.

What happens when the attack succeeds

A hijacked UniFi OS hands the attacker control of the entire network below. Concrete scenarios:

The hard part is that network device compromises are hard to notice. PC malware trips antivirus, but an attacker quietly intercepting traffic inside a router or switch is essentially invisible from the endpoints. Cases of "we just realized our internal communications had been siphoned for six months" are entirely plausible in this category.

Home users running UniFi are in the same boat. Family PCs, smartphones, and smart home devices — all their traffic becomes visible to the attacker. Tech-loving individual users cannot consider this someone else's problem.

Affected products and fixes

The advisory covers any product running "UniFi OS". UniFi OS is the common platform underneath Ubiquiti's management appliances, and runs on the following representative products:

The remediation is straightforward: update UniFi OS to the latest version. Use one of the following paths:

If automatic updates are enabled, the new firmware may already be deployed. Verify that the "UniFi OS Version" shown on the dashboard is at or above the fixed version listed in Bulletin 064. Specific version numbers are updated on Ubiquiti's official advisory page.

Interim mitigations to apply at minimum

Until the patch is applied — and for longer-term risk reduction — the following settings are recommended:

The WAN-side dashboard exposure in particular has been a recurring root cause of UniFi compromises in the past. If you don't know who turned on "Allow Remote Access" or when, turning it off is the right move until you do.

Ubiquiti has been a target before

Thanks to their value-for-money pricing and broad install base, Ubiquiti products have long been an appealing target for attackers.

In 2021, a major credential exposure incident around the UniFi Cloud functionality led Ubiquiti to urge customers to change their passwords. From 2022 onward, high-severity flaws have surfaced intermittently in UniFi Dream Machine, UniFi Protect (camera management), and the UniFi Network Application. Even earlier in 2026, before today's batch, CVE-2026-22557 (path traversal) and CVE-2026-22558 (privilege escalation) were already on the books.

This is not "Ubiquiti is uniquely buggy". It should be read as a problem common to the entire network device category. Vulnerabilities in Cisco, Fortinet, Pulse Secure, and similar products have become primary entry vectors for APT (nation-state) and ransomware groups in recent years. The attacker's gaze rests on home, SOHO, and mid-market networks alike.

Conversely, a vendor publishing advisories on a regular cadence is a healthy state of affairs. The real question is whether the user side has the awareness and operational muscle to act on those advisories quickly.

Closing thoughts

Three CVSS 10.0 vulnerabilities in a single advisory, all exploitable remotely without authentication, is about as bad a package as a networking-gear security disclosure can get. Ubiquiti has done its part by publishing Bulletin 064 clearly, but if user-side updates do not catch up, this lines up directly with real-world compromises.

Teams operating UniFi in small offices, and engineers running UniFi at home — log in to the dashboard now and check your version. Even if you have automatic updates enabled, visually confirming that the patch landed is worthwhile. "UniFi: set it and forget it" is the selling point, which is exactly why undoing the "forget" is a job for tonight.

References

• ▸ Ubiquiti Community - Security Advisory Bulletin 066 (July 2, 2026, 15 new flaws)
• ▸ NVD - CVE-2026-50746 (UniFi Connect, unauthenticated command injection, CVSS 10.0)
• ▸ CISA - Known Exploited Vulnerabilities Catalog (KEV)
• ▸ Bishop Fox - Popping Root on UniFi OS Server: Unauthenticated RCE Chain
• ▸ GitHub - BishopFox/CVE-2026-34908-check (free detection script)
• ▸ BleepingComputer - Critical UniFi OS bug lets hackers gain root without authentication
• ▸ Ubiquiti Community - Security Advisory Bulletin 064
• ▸ Ubiquiti Community - Security Advisory Bulletin 065 (June 2026 follow-up)
• ▸ NVD - CVE-2026-47369 (privilege escalation, CVSS 9.9)
• ▸ NVD - CVE-2026-47370 (command injection, CVSS 9.9)
• ▸ NVD - CVE-2026-47367 (UID Enterprise Agent, CVSS 9.9)
• ▸ NVD - CVE-2026-47368 (path traversal, CVSS 8.6)
• ▸ NVD - CVE-2026-34908 (Improper access control, CVSS 10.0)
• ▸ NVD - CVE-2026-34909 (Path traversal, CVSS 10.0)
• ▸ NVD - CVE-2026-34910 (Command injection, CVSS 10.0)
• ▸ NVD - CVE-2026-33000 (Command injection, CVSS 9.1)
• ▸ NVD - CVE-2026-34911 (Path traversal, CVSS 7.7)
• ▸ Ubiquiti Japan - What is UniFi? (deep dive)
• ▸ Ubiquiti Japan official site