Ubiquiti UniFi: firmware and controller updates

Updated November 2026

A UniFi network has three layers to patch: the console's UniFi OS, the applications on it (Network, Protect and others), and the firmware on each access point, switch and gateway. Turn on auto-updates for all three, watch Ubiquiti's Security Advisory Bulletins, and never expose the console's login page to the internet.

What needs patching

UniFi OS: The operating system on the console: Cloud Gateways and Dream Machines, CloudKeys, NVRs, and UniFi OS Server for self-hosting. Several 2026 bulletins fixed serious flaws here.
Applications: UniFi Network, Protect, Access, Talk and others run on UniFi OS and update separately.
Device firmware: Access points, switches and other adopted devices get firmware through the Network application.

Bulletin 067 (August 26, 2026) shows why all three matter. It listed 22 flaws, including a privilege escalation in UniFi OS rated 9.9 out of 10 (fixed in UniFi OS 5.1.31 for consoles and 5.1.37 for UniFi OS Server) and a command injection in the Network application (fixed in 10.5.67).

Turn on auto-updates

Ubiquiti's own advice is that most users should enable automatic updates. Set it once per console:

Open the console locally or through Site Manager at unifi.ui.com.
Go to Settings > Control Plane > Updates.
Click the console (for UniFi OS) or each application, choose the Official release channel and switch on auto-update, with a schedule that suits you.

Device firmware updates are set inside the application that manages the devices, not on the console page. In UniFi Network, open UniFi Devices and then Device Updates and Settings (bottom-left) and turn on automatic device updates. Leave the Early Access channel off on production networks.

The Update Manager in Site Manager shows every pending update across all your sites in one list, which helps if you run several consoles. If remote management is off, the same settings work through local access.

Expect short interruptions. A device restarts to load new firmware, so an access point drops its Wi-Fi clients for a moment, and a Cloud Gateway that is also your router can briefly cut internet access. Schedule auto-updates for a quiet hour.

Update by hand when a bulletin lands

Do not wait for the next scheduled window after a critical bulletin. Open Settings > Control Plane > Updates (or Update Manager) and install the fixed version of UniFi OS and the affected application now, then update device firmware from the UniFi Devices page. Compare the installed version with the "Update ... to Version X or later" line in the bulletin.

If updates fail, check that the console has working DNS, and that outbound UDP 53 and 123 are not blocked. Ubiquiti treats SSH updates as a last resort, to be used only when Support asks; they can leave a console unusable. For reference, Support may ask you to run commands like these on the device:

# UniFi console or gateway (as root, over SSH)
ubnt-systool fwupdate <firmware-link-from-community.ui.com>

# UniFi access point or switch
upgrade <firmware-link-from-community.ui.com>

Expect the device to restart to load the new firmware.

Back up first

Go to Settings > Control Plane > Backups and tick System Backups. The console then saves a cloud backup to the owner's UI account every week and before each major update. Download an offline backup file from the same page before any manual upgrade and keep it off the console. To roll back a bad configuration, use Restore on the same page.

Self-hosted controllers

If you run the controller on your own server, there are now two kinds:

UniFi OS Server is Ubiquiti's current self-hosting product for Linux, Windows and macOS. It uses the same update settings as a console and gets UniFi OS fixes (Bulletin 067 needed 5.1.37 or later).
The legacy UniFi Network Server must be checked and updated by hand every time. Network application 11.0 removed support for it, and 10.6 is the last version that supports the old USG gateway. On a Debian or Ubuntu server that uses Ubiquiti's APT repository, update with the command below. The controller is unavailable while it updates, but devices keep passing traffic.

sudo apt-get update && sudo apt-get install unifi -y

Ubiquiti recommends moving self-hosted deployments to UniFi OS Server. Plan that move now: Network 10.6 still got an update in October 2026 (10.6.109), but 11.0 and later no longer support the legacy server. Back up the Network database from its System Settings before every update.

Remote access settings

Remote management through Site Manager is on by default. It needs only outbound connections on TCP 443 and 8883; Ubiquiti says no inbound ports need to be opened. So there is no reason to port-forward the console's web interface (443, or 8443 on a self-hosted Network Server) or SSH to the internet.

Do not create port forwards to the console, a CloudKey or a self-hosted controller.
Protect the UI account used for Site Manager with a strong unique password and multi-factor authentication; whoever controls it controls every site.
If you want a local-only setup, untick Remote Management under Settings > Control Plane > Console. You then update through local access.
Leave console SSH off (the default) and turn it on only when needed, in the same Console settings.
Devices have SSH on by default with random credentials; review them under Device Updates and Settings > Device SSH Authentication and use keys.
Give admin roles only to people who need them, and remove old admins.

If you suspect someone used an admin login, follow Leaked credentials.

Security advisory bulletins

Ubiquiti publishes numbered Security Advisory Bulletins in the Security section of community.ui.com/releases, with an RSS feed. In 2026 they came out about once a month, from Bulletin 061 (January 6) to Bulletin 072 (October 29). Each one lists the affected products and versions, a CVSS score, and the version to install. Add the feed to your monitoring and act on any bulletin that names UniFi OS, an application you run, or your device models. Release notes for each version are posted in the same releases section.

Old hardware and versions

Bulletins name minimum fixed versions. If a device cannot install that version, it stays vulnerable. Network application 11.0 needs UniFi OS 6.0 or newer, and USG gateways stop at Network 10.6. Replace hardware that no longer gets the fixed versions, and move off the legacy self-hosted server. See Is my OS supported? for planning.