UniFi Talk EUVD-2026-66403

Exploitation requires network reachability to the UniFi Talk Application service on the host device; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed against a reachable instance, so any attacker able to route packets to the Talk service can attempt it. The primary limiting factor is exposure: the console running UniFi Talk must be reachable by the attacker (LAN, adjacent segment, or internet-exposed management interface), so deployments that confine the console to an isolated management network or do not run the Talk application at all are not exploitable via this path. Note that 'access to the network' in the description and AV:N should be reconciled with your segmentation - verify whether the Talk service is actually internet-facing before assuming fully remote exposure.

This is a genuine top-priority issue rather than an inflated high-CVSS score: the vendor-supplied vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes an unauthenticated, low-complexity, network-reachable command injection with scope change and total confidentiality/integrity/availability loss - the maximal 10.0 rating. Counterbalancing signals: there is no EPSS score, POC, or CISA KEV entry in the provided data, so there is currently no evidence of active or automated exploitation, which tempers urgency somewhat but does not lower the intrinsic severity. The most important caveat is exposure scope - 'access to the network' plus AV:N implies the attacker must reach the Talk service, so real-world risk hinges heavily on whether the console is internet-exposed or confined to a management LAN; even a mid-sized operator running a handful of UniFi consoles should patch immediately given the trivial exploitability and full host takeover, while noting the PR:N/network claim should be validated against your actual network segmentation.

An attacker who can reach the UniFi Talk service on the network sends a crafted request containing shell metacharacters in an insufficiently validated input field, which the host executes as an OS command, granting arbitrary code execution on the console. Because scope is changed (S:C), the attacker pivots from the Talk application to full control of the underlying host device. No public POC is identified at time of analysis, but the low attack complexity means weaponization would be straightforward.