CVE-2026-50746: A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Injection on the host device

Synopsis

An improper access control flaw in Ubiquiti's UniFi Connect Application allows an unauthenticated, network-reachable attacker to inject and execute arbitrary operating system commands on the host device. No credentials and no victim interaction are needed; the attacker only requires network access to the service. Successful exploitation gives the attacker full control over the host, including reading all data, modifying any files or configuration, and crashing or hijacking the process. A patched-image rebuild at version 3.4.20 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the UniFi Connect Application service over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials of any kind are needed to trigger the command injection.

• Victim interactionNot required

  The attacker does not need to manipulate any user into taking an action; exploitation is fully self-initiated.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environment-specific configuration.

Blast Radius

• The attacker executes arbitrary OS commands on the host device with the privileges of the application process.
• All data accessible to that process, including stored credentials, device configuration, and session tokens, is readable by the attacker.
• The attacker can modify or delete any files, configuration, or persistent state the process can write to.
• The host process and the services it manages can be crashed or taken over entirely, causing a full denial of service.