A client calls because cameras are dropping or the network feels sluggish. Most days, that turns into a routine service visit. You check the access points, reboot the controller, glance at the switch, and head to the next job.
This week, that same call deserves a second look.
Ubiquiti has patched multiple critical flaws affecting UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS, according to The Hacker News and Ubiquiti’s own Security Advisory Bulletin 066. The one that should get your attention is CVE-2026-50746, an improper access control flaw in the UniFi Connect Application carrying a CVSS score of 10.0. The CVSS scale rates anything from 9.0 up as Critical, and it tops out at 10.0. This one maxed out the scale.
You already know how much UniFi gear is sitting in the field. It runs networks in homes, offices, clubhouses, estates, and small businesses where the client assumes somebody is keeping an eye on things.
If you installed that network, the somebody is you.
UniFi deployments rarely stop at access points. They tie into cameras, door access, voice, admin accounts, and remote management. A system that falls behind on patches puts more at risk than one misbehaving device. It opens a path into everything the client runs on that network.
There's a liability angle here too. When you install and support the network, your number is the one clients dial when something fails or a vulnerability makes the news. A documented patch and review process protects them, and it protects you.
The advisory covers several serious issues across the UniFi ecosystem. CVE-2026-50746 leads the list, an improper access control vulnerability in the UniFi Connect Application that could allow command injection on the host device. The rest of the batch includes SQL injection, improper input validation, server-side request forgery, privilege escalation, and command injection flaws.
The Hacker News reported no evidence that these newly patched flaws had been exploited in the wild at the time of publication. Treat that as a head start rather than a reason to wait. Nobody wants to explain to a client why a known 10.0 sat unpatched on their network.
There’s also recent precedent for moving fast on UniFi advisories. In June, CISA added two separate Ubiquiti UniFi OS vulnerabilities, CVE-2026-34908 and CVE-2026-34909, to its Known Exploited Vulnerabilities Catalog. Different flaws from this advisory, same lesson. When UniFi makes the security news, attackers pay attention.
Pull your list of every site where you installed, support, or recommended Ubiquiti equipment, and start working through it.
At each site, compare the UniFi application and UniFi OS versions against the advisory. Auto-updates miss things more often than anyone likes to admit, so confirm the actual version and write down what you found.
Prioritize sites with remote access enabled, internet-facing management, cameras, access control, voice systems, high-value residences, family offices, or commercial networks where multiple users and vendors touch the environment.
Once the updates land, spend a few extra minutes on the settings that turn a vulnerability into an incident. Review admin accounts and role-based access. Look at remote access settings, exposed ports, and VPN configurations. Clear out unused user accounts, hunt for unknown devices, and confirm the network segmentation still holds up.
Site Review Checklist