CRITICALVulnerability
Global

Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS

·Source: The Hacker News

Updated:

Executive Summary

Ubiquiti has shipped updates to address multiple critical security flaws impacting UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS that could result in privilege escalation and arbitrary command execution. The list of vulnerabilities is as follows - CVE-2026-50746 (CVSS score: 10.0) - An improper access control vulnerability in UniFi Connect Application that an attacker

Analysis

Ubiquiti has shipped updates to address multiple critical security flaws impacting UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS that could result in privilege escalation and arbitrary command execution. The list of vulnerabilities is as follows - CVE-2026-50746 (CVSS score: 10.0) - An improper access control vulnerability in UniFi Connect Application that an attacker

Indicators of Compromise (1)

CVE (1)
CVE-2026-50746
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Jul 8, 2026.

Related Threats

MEDIUMVulnerability

RedWing Android Spyware Sold as a Service on Telegram

Zimperium found RedWing, an Android spyware sold as a service via Telegram to target banking apps

Infosecurity Magazine
MEDIUMVulnerability

Why Bangladesh’s new data protection law may fail to protect your data

Meem Arafat Manab reports: On August 19, 2025, hackers broke into Shwapno’s customer database. They took 410 gigabytes of data: the names, phone numbers, and purchase histories of forty lakh registered customers. They demanded $1.5 million. Shwapno refused, secured its systems, and said nothing to its customers for seven months. When the hackers published the... Source

DataBreaches.net
HIGHVulnerability

NVD HIGH: CVE-2026-59703 — repomix contains a local file inclusion vulnerability in the git clone endpoint ...

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to a

CVE-2026-59703
NIST NVD