CVE-2026-50747
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
An authenticated SQL Injection vulnerability in UniFi Talk Application allows a network-accessible attacker with low privileges to escalate privileges on the host device.
Risk Assessment
An attacker could gain unauthorized access to sensitive data or take control of the device, compromising system integrity and confidentiality.
Recommendation
Immediately update UniFi Talk Application to the latest patched version and restrict network access for untrusted users.
Other vulnerabilities in UniFi Talk Application
See all- CVE-2026-77554Critical
An attacker with network access could exploit an Improper Input Validation vulnerability in UniFi Talk Application to execute a Command Injection on the host device.
- CVE-2026-55119High
An Improper Access Control vulnerability in UniFi Talk Application allows privilege escalation. An attacker with network access and low privileges can exploit this flaw.
Original NVD description (English source)
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS