UniFi Connect Application CVE-2026-50746

The attacker must have network access to the UniFi Connect Application service (AV:N, network-reachable), but requires no valid credentials and no user interaction (PR:N/UI:N) because the flaw is an access-control bypass - the vulnerable function is reachable without authorization. Exploitation targets default deployments of the Connect Application with no special feature toggle documented as a prerequisite in the available data. The primary limiting factor is network reachability: if the management interface is segmented behind a firewall or VPN, the effective attack surface shrinks to those with access to that segment; there is no version restriction published, so all unpatched instances should be assumed vulnerable.

This is a genuine top-priority issue, not an inflated high-CVSS score. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0) describes remote, low-complexity, unauthenticated exploitation with no user interaction, a scope change, and total confidentiality/integrity/availability impact - the combination of an access-control bypass feeding command injection makes each metric credible rather than exaggerated. The tags (Authentication Bypass + Command Injection) reinforce the vector. Countervailing signals: EPSS was not supplied, the CVE is not in CISA KEV, and no POC is referenced, so there is currently no evidence of active or automated exploitation despite the maximal severity. In short, the theoretical impact is maximal and the barrier to exploit is minimal, but observed real-world exploitation is presently unconfirmed; treat as urgent to patch while recognizing exploitation status is not yet established.

An attacker with access to the same network segment as the UniFi Connect Application sends a crafted request to an improperly protected endpoint, bypassing authentication and embedding shell metacharacters in a parameter that the app passes to a host command. The command executes with the service's privileges, giving the attacker a foothold to run arbitrary code, exfiltrate data, and pivot to other systems. No POC is referenced in the provided data, but the low attack complexity and lack of required authentication make weaponization straightforward if the endpoint is exposed.