CVE-2026-50748
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
A vulnerability in the UniFi Access Application allows an attacker with network access and low privileges to execute command injection on the host device due to improper input validation.
Risk Assessment
An attacker can take control of the device, compromising confidentiality, integrity, and availability, and potentially spreading the attack across the network.
Recommendation
Immediately update the UniFi Access Application to the latest patched version and restrict network access to the application to trusted hosts only.
Other vulnerabilities in UniFi Access Application
See all- CVE-2026-77553Critical
An attacker with network access and low privileges could exploit an Improper Access Control vulnerability in UniFi Access Application to escalate privileges on the host device.
- CVE-2026-77547Critical
An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Access Application to execute a Command Injection on the host device.
- CVE-2026-77546Critical
An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Access Application to execute a Command Injection on the host device.
- CVE-2026-77543Critical
An attacker with network access and low privileges can exploit an improper input validation vulnerability in the UniFi Access Application to execute a command injection on the host device.
- CVE-2026-54400Critical
A vulnerability in UniFi Access Application allows privilege escalation on the host device. An attacker with network access and high privileges can exploit improper access control.
- CVE-2026-55117High
A Path Traversal vulnerability in UniFi Access Application allows a malicious actor with network access to read files on the host device.
Original NVD description (English source)
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS