CVE-2026-50747 -- CVSS 9.9 Vulnerability Briefing

CVE-2026-50747 | CVSS 9.9 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-50747 is a series of authenticated SQL injection vulnerabilities in the Ubiquiti UniFi Talk application that allow a low-privileged network-authenticated attacker to escalate privileges on the underlying host.

Technical Detail

The vulnerabilities exist within multiple SQL query handling points in the UniFi Talk application, where user-supplied input is insufficiently sanitized before being passed to database queries. An attacker with low-level authenticated access to the network can craft malicious SQL payloads to manipulate query logic, potentially extracting sensitive data or abusing database execution paths to achieve privilege escalation on the host system. The chained nature of these injection points raises the effective impact beyond typical SQL injection, as successful exploitation can result in full host-level privilege escalation rather than database-scoped access alone, which accounts for the near-maximum CVSS score of 9.9.

Exploitation Status

No known exploit code has been identified at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit as of July 09, 2026. This status should be monitored closely given the critical severity rating and the relatively low barrier to exploitation for an authenticated attacker.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability. Organizations should not interpret the absence of attribution as an indicator of reduced risk, particularly given the severity and the broad deployment of UniFi Talk in enterprise and SMB environments.

What To Do

Apply any available patches or updates from Ubiquiti for the UniFi Talk application immediately, prioritizing this as a critical-severity fix given the CVSS score of 9.9. Restrict network access to the UniFi Talk application to trusted, authorized users only, and enforce the principle of least privilege for all accounts with application access. Monitor application and database logs for anomalous SQL query patterns or unexpected privilege changes that could indicate exploitation attempts. Until a patch is confirmed applied, consider isolating the UniFi Talk service from broader network segments where untrusted low-privileged users may have access. Check Ubiquiti's official security advisories and the UniFi Talk release notes for patch availability and version-specific guidance.