What is the CVSS score of CVE-2026-50746?

CVE-2026-50746 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of UniFi Connect Application are affected by CVE-2026-50746?

Ubiquiti's UniFi Connect Application is vulnerable to a critical flaw that enables network attackers to gain complete control without authentication, risking unauthorized access to network…. A patch is available.

How to fix or mitigate CVE-2026-50746?

Within 24 hours: Isolate UniFi Connect Application instances from untrusted networks; review and preserve access logs for forensic analysis. Within 7 days: Implement network segmentation (VLAN isolation and firewall rules) restricting access to the application to trusted management networks only; enable application-level logging and configure SIEM alerting for unusual command execution patterns. Within 30 days: Establish daily monitoring of Ubiquiti security advisories; evaluate business continuity plans and alternative solutions; coordinate with Ubiquiti on patch timeline.

UniFi Connect Application CVE-2026-50746

EUVD-2026-41389 CRITICAL

Improper Access Control (CWE-284)

2026-07-02 hackerone

GHSA-8q6j-36ff-q77x

Authentication Bypass Ubiquiti Command Injection Unifi Connect Application

10.0

CVSS 3.1 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Network-reachable unauthenticated access-control bypass (AV:N/PR:N/UI:N) feeding OS command injection that escapes the app to the host gives S:C and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 02, 2026 - 16:17 EUVD

Analysis Generated

Jul 02, 2026 - 15:30 vuln.today

DescriptionCVE.org

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Injection on the host device.

Articles & Coverage 1

News Critical Auth Bypass & RCE in Ubiquiti UniFi Connect - CVE-2026-50746 Jul 02, 2026

AnalysisAI

Improper access control in Ubiquiti's UniFi Connect Application allows a network-adjacent attacker to bypass authentication and inject arbitrary operating-system commands on the underlying host, yielding full compromise (CVSS 10.0). The flaw chains an access-control weakness (CWE-284) with command injection, so an unauthenticated attacker reachable on the network can execute code with the application's privileges and pivot beyond the app boundary (scope change). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

UniFi Connect is Ubiquiti's application platform (Connect Application server) used to manage UniFi Connect signage/EV/display devices and related endpoints, typically deployed as a network-resident service or on UniFi hosting hardware. The root cause is classified as CWE-284 (Improper Access Control): a protected function or API path is reachable without proper authorization, effectively an authentication bypass. That exposed path passes attacker-controlled input into a host command execution context, producing OS command injection. The CPE cpe:2.3:a:ubiquiti_inc:unifi_connect_application:*:*:*:*:*:*:*:* indicates the affected component is the application itself across all listed versions, with no lower/upper version bound published in the provided data.

RemediationAI

Upgrade UniFi Connect Application to the fixed release identified in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); the advisory confirms a patch is available, though an exact fixed version number is not included in the provided data, so confirm the specific build from the bulletin. Because the vulnerability is a remote unauthenticated authentication bypass, until patching is complete restrict network reachability of the Connect Application management interface - place it behind a firewall or VPN and allow only trusted management subnets, which limits exposure at the cost of remote/off-site administration convenience. Additionally, monitor the host for anomalous child processes spawned by the application (a signature of command injection) and rotate any credentials or keys handled by the service after upgrading, since a scope-changing RCE could have exposed them.