Affected Vendors This Week:
- Ubiquiti: 25 CVEs (7 critical, 18 high)
- Cisco: 1 CVE (1 high)
- TP-Link: 1 CVE (1 medium)
Overview
This week brings a significant security event dominated by Ubiquiti, which accounts for 25 of the 27 new CVEs. Seven of those are rated critical with CVSS scores ranging from 9.0 to 10.0 — among the highest severity ratings possible. The vulnerability landscape spans multiple UniFi applications and the underlying UniFi OS platform, affecting a broad range of deployments.
Critical Ubiquiti Vulnerabilities
The most severe vulnerability this week is CVE-2026-50746 (CVSS 10.0), an Improper Access Control flaw in UniFi Connect Application that allows command injection on the host device. This is joined by five additional critical vulnerabilities with CVSS scores of 9.9:
- CVE-2026-55115: Server-Side Request Forgery (SSRF) in UniFi Protect enabling privilege escalation
- CVE-2026-54402: Improper Input Validation in UniFi OS leading to command injection
- CVE-2026-50747: Authenticated SQL Injection in UniFi Talk Application for privilege escalation
- CVE-2026-50748: Improper Input Validation in UniFi Access Application enabling command injection
A sixth critical issue, CVE-2026-54400 (CVSS 9.1), is an Improper Access Control vulnerability in UniFi Access requiring high privileges to exploit. Additionally, CVE-2026-55116 (CVSS 9.0) affects UniFi OS under certain network configurations.
All seven critical vulnerabilities assume network access, with most requiring low to high privilege levels already on the network. This means insider threats or lateral movement from an initially compromised device pose significant risk.
High-Severity Ubiquiti Issues
Beyond the critical tier, Ubiquiti's remaining 18 high-severity CVEs continue the pattern of SQL injection, improper access control, and input validation issues across UniFi Network, Protect, Access, and OS components. Notable examples include:
- CVE-2026-56841: Authenticated SQL Injection in UniFi Protect (CVSS 8.8)
- CVE-2026-55114: Improper Access Control in UniFi Network Application (CVSS 8.8)
- CVE-2026-54404: Authenticated SQL Injection in UniFi OS (CVSS 8.8)
Other Vendors
CVE-2026-20191 (Cisco Catalyst Center, CVSS 7.5) is an unauthenticated remote vulnerability allowing arbitrary file reads from a restricted container. Despite the lack of authentication requirement, the 7.5 score and file read scope are moderate concerns for Catalyst Center administrators.
CVE-2026-9105 (TP-Link TL-WR841N v14, CVSS 6.5) is an authenticated stack-based buffer overflow in the web management interface — lower severity but still requires attention in small office environments relying on these devices.
Recommendations
- Ubiquiti users: Prioritize patching immediately. Check Ubiquiti's security advisory for affected firmware versions and apply updates to UniFi OS and all applications (Connect, Protect, Talk, Access, Network). If patching is delayed, restrict network access to UniFi management interfaces.
- Cisco Catalyst Center: Apply the latest patches and review access logs for suspicious file access attempts.
- TP-Link TL-WR841N v14 users: Restrict web management access to trusted IPs only and consider firmware updates if available.
This week underscores the importance of maintaining an updated patch management schedule, especially for unified infrastructure platforms like Ubiquiti's suite where a single OS or application update may address multiple critical flaws.