UniFi Access CVE-2026-50748

Exploitation requires network access to the UniFi Access Application and a valid low-privilege account (CVSS PR:L) - this is authenticated exploitation, not unauthenticated. No user interaction is needed (UI:N) and complexity is low (AC:L). The specific enabling condition per the description is that attacker-controlled input reaches a command-execution path on the host due to improper input validation; the concrete injectable parameter/feature is not named in the available data. Limiting factors that reduce real-world exposure: an attacker must first obtain low-privilege credentials/access to the application, and must be able to reach it on the network, so instances isolated to trusted management networks are substantially harder to exploit.

The signals point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) describes network-reachable, low-complexity exploitation needing only low privileges and no user interaction, with full confidentiality/integrity/availability impact and a scope break onto the host - effectively remote code execution for an authenticated user. Under an SSVC lens this trends toward high (network automatable exploitation, total technical impact), tempered by the PR:L authentication requirement, which raises the bar versus a fully unauthenticated flaw. Mitigating the urgency: no EPSS score was provided, the CVE is not in CISA KEV, and no public POC is referenced, so there is no evidence of active or widespread exploitation yet. The most notable data gap is the absence of an exact fixed version in the provided input - the reference is a vendor advisory bulletin rather than a pinned release - so defenders should confirm the patched build directly from Ubiquiti.

An attacker who holds a low-privileged account on the UniFi Access Application and can reach it over the network submits crafted input to a field that is improperly validated, embedding shell metacharacters that the application passes to the host command interpreter. The injected commands execute on the underlying UniFi host device, giving the attacker code execution outside the application boundary. No public POC is referenced, and the low attack complexity (AC:L) means a working technique would be reliably repeatable once discovered.