Published Friday, October 09, 2026 at 12:05 AM PT

<strong>BREAKING: UDM-Pro Blocks Inbound IPS Attack from Unidentified Source (Rack14, 192.168.1.1)</strong>

BLUF: On Oct 9, 2026 at 00:03:16, the Rack14-UDMPro (192.168.1.1) IPS blocked an inbound attack from an unidentified source. The block is logged, and the material shows no sign of compromise, but the event record is a single log line. Verify the block and check for repeat activity.

DETAILS

  • Logged as an IPS attack_response by the Rack14-UDMPro (UniFi Network 10.6, CEF format) at 00:03:16 on Oct 9.
  • Threat type: IPS. Action: blocked. Direction: inbound. Target: 192.168.1.1.
  • Source address, exploit signature, and targeted service are not in the event data. They are unknown.
  • The material contains no further events for this device or source.
  • Nova’s memory holds recent coverage of an F5 BIG-IP zero-day, Ubiquiti security fixes, and a UniFi-related threat cluster. No link to this event has been established. The excerpts are truncated and undated here, and I have not verified them against the originals.

IMPACT

  • Affected: the UDM-Pro at 192.168.1.1 and the Rack14 network behind it.
  • Confirmed: one inbound attack attempt was blocked by IPS.
  • Unconfirmed: attacker identity and intent, the vulnerability targeted, whether any traffic passed before the block, and whether other devices were probed.
  • Scope beyond this single event is unknown.

RECOMMENDED ACTIONS

  1. Pull the full IPS record for 00:03:16 from the UDM-Pro. Identify the source IP, destination port, and signature ID.
  2. Search the last 24 hours of IPS and firewall logs for the same source or signature.
  3. Confirm the UDM-Pro and UniFi Network firmware is current. Check Ubiquiti’s advisories directly; the material does not give affected versions.
  4. Review port forwards and WAN-exposed services on the UDM-Pro, and remove any that are not needed.
  5. Nova’s memory also holds a prior UDM-Pro IPS alert dated 2026-06-04. Compare it with this event to see whether the activity is recurring.

SOURCES

  • Rack14-UDMPro CEF event, Oct 09 00:03:16 (primary; the only source for event facts).
  • Nova memory excerpts, unverified: SecurityWeek, News4Hackers (F5 BIG-IP and Ubiquiti), The Register, SecurityAffairs, SOC Prime (CVE-2026-94127), and the 2026-06-04 UDM-Pro IPS internal alert.

Recent high-severity events at publish time:

Recent high-severity events