A malicious actor with access to the network could exploit an Improper Access Control vulnerability found…

CVE-2026-50746 is an improper access control flaw (CWE-284) in the UniFi Connect Application — Ubiquiti's smart-building management suite that orchestrates commercial lighting, EV chargers, digital signage, and door hardware. In versions ≤ 3.4.16 (NVD lists < 3.4.20 as affected), a command-execution code path is reachable *without* passing through the authentication gate. Any actor with network reachability to the Connect Application host can drop unauthenticated HTTP(S) at the exposed API and get arbitrary OS command execution as the service user on the underlying UniFi OS host. The vendor patched in 3.4.20.

The vendor CRITICAL / 10.0 label is defensible here — this is the rare case where CVSS matches operational reality. AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H is technically accurate: no creds, no clicks, and scope changes because the Connect Application typically runs on a UniFi OS console (UDM/UDM Pro/UDR/UNVR/Cloud Key) that also hosts network, camera, and access controllers. Compromise doesn't stop at Connect — it lands you on the appliance that runs your network edge and physical access. The only reason we don't push above vendor is that most Connect deployments sit on internal management VLANs rather than the public internet.

Why this verdict

• Unauthenticated + network-reachable + RCE: no credentials, no clicks, low complexity — the three ingredients that make a bug worth waking up for.
• Role multiplier — network edge appliance: UniFi OS is canonically an edge / management-plane device. Chain succeeds → attacker owns firewall rules, VPN config, and (where UniFi Access is deployed) door-unlock authority. Blast radius = site network + physical access. Floor is CRITICAL.
• Role multiplier — smart-building / OT-adjacent role: Connect specifically manages EV chargers, lighting, and building automation. In deployments where Connect drives real hardware, the chain reaches operational impact — not just IT.
• Exposure telemetry does not save you: even if only a fraction of the ~100,000 exposed UniFi OS endpoints run Connect, the absolute count of externally reachable targets is in the tens of thousands — internet-scan-and-pop is economical.
• Patch diff availability: 3.4.16 vs 3.4.20 is a trivial reverse. PoC and mass-scan tooling are on a days-to-weeks clock, not months.

Why not higher?

There is no severity bucket higher than CRITICAL. If there were, we'd still hold at CRITICAL: no confirmed in-the-wild exploitation yet, EPSS is still low, and enterprise deployments frequently restrict the Connect UI to an internal management VLAN — the population of *internet-exposed* Connect instances is a subset of the 100,000 UniFi OS endpoints, not the full number.

Why not lower?

Downgrading to HIGH would require either a meaningful auth prerequisite or a narrow blast radius — neither applies. The bug is pre-auth, the affected component is a management appliance with fleet-scale physical-and-network authority, and public exposure is measured in tens of thousands. Any of the standard downgrade levers (needs creds, needs UI click, one-tenant blast radius, sub-1% exposure) is absent here.

1. Block Connect Application ports at the perimeter today — Confirm no WAN-side ACL permits inbound to the UniFi OS management ports (TCP 443/8443/8843) on any UDM/UDR/UNVR/Cloud Key running Connect. Push this via your edge firewall change window within the noisgate CRITICAL mitigation SLA of ≤3 days.
2. Restrict Connect UI to a mgmt jump-host subnet — Add an interface ACL on the UniFi OS host itself limiting the Connect Application listener to your IT admin CIDR. Belt-and-braces in case perimeter rules are bypassed by a compromised internal host. Same 3-day window.
3. Upgrade to UniFi Connect Application 3.4.20 or later — Roll the vendor patch fleet-wide within the noisgate CRITICAL remediation SLA of ≤90 days. Ubiquiti pushes via the standard Applications update channel; auto-update is safe for this release per SAB-066 notes but validate in a canary group first if you have >50 sites.
4. Enable syslog forwarding from UniFi OS to your SIEM — Ship audit logs, admin actions, and Access door-unlock events to Splunk / Sentinel / Elastic so any post-compromise config or door-state change is visible. Do this in parallel with the patch — value outlives this CVE.
5. Rotate Connect and Access API tokens post-patch — If any Connect deployment was internet-reachable prior to 3.4.20, assume tokens and integration credentials may have been read post-RCE and rotate them once patched.

Run this on an auditor workstation or jump host that can reach your UniFi OS consoles' management IPs. It queries the Connect Application's version endpoint over HTTPS and compares against the patched version 3.4.20. Invoke as ./check-cve-2026-50746.sh 10.0.0.1 for a single host, or pipe an inventory: cat unifi-ips.txt | xargs -n1 ./check-cve-2026-50746.sh. No credentials required.

#!/usr/bin/env bash
# noisgate check for CVE-2026-50746 — UniFi Connect Application unauth RCE
# Usage: ./check-cve-2026-50746.sh <host-or-ip> [port]
# Exits: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u

HOST="${1:-}"
PORT="${2:-443}"
FIXED="3.4.20"

if [[ -z "$HOST" ]]; then
  echo "usage: $0 <host> [port]" >&2
  exit 2
fi

# Query Connect Application info endpoint; UniFi OS surfaces app versions via /api/applications
RESP=$(curl -ksS --max-time 8 "https://${HOST}:${PORT}/api/applications" 2>/dev/null || true)

if [[ -z "$RESP" ]]; then
  echo "${HOST} UNKNOWN (no response from UniFi OS API)"
  exit 2
fi

# Extract Connect app version (JSON field name varies by UniFi OS release)
VER=$(echo "$RESP" | grep -oE '"(name|slug)"\s*:\s*"connect"[^}]*"version"\s*:\s*"[0-9.]+"' \
      | grep -oE '"version"\s*:\s*"[0-9.]+"' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)

if [[ -z "$VER" ]]; then
  echo "${HOST} UNKNOWN (Connect Application not installed or API shape differs)"
  exit 2
fi

# Semver compare: is VER >= FIXED ?
newest=$(printf '%s\n%s\n' "$VER" "$FIXED" | sort -V | tail -1)
if [[ "$VER" == "$FIXED" || "$newest" == "$VER" && "$VER" != "$FIXED" ]]; then
  echo "${HOST} PATCHED (Connect ${VER} >= ${FIXED})"
  exit 0
else
  echo "${HOST} VULNERABLE (Connect ${VER} < ${FIXED}) — CVE-2026-50746"
  exit 1
fi

Sources

1. SOCRadar — CVE-2026-50746 in UniFi Connect
2. The Hacker News — Ubiquiti patches critical UniFi flaws
3. BleepingComputer — max severity UniFi OS vulnerability
4. Security Affairs — Ubiquiti patches critical UniFi OS flaws
5. Tech Times — CVSS 10.0 flaw exposes 100,000 endpoints (Censys)
6. Cybersecurity News — 25 UniFi ecosystem vulnerabilities
7. BeyondMachines — patches following active exploitation reports
8. Ubiquiti Security Advisories (SAB-066)