Published Tuesday, October 13, 2026 at 06:24 AM PT

<strong>BREAKING: Inbound IPS Block on Rack14-UDMPro, Source Unknown, Target 192.168.1.1</strong>

An inbound intrusion-prevention event on the Rack14-UDMPro gateway was blocked at 06:23:05 on Oct 13, 2026. The attack source is unidentified, and no signature, CVE, or exploit name is available. No compromise is confirmed. Check the UniFi IPS log for the source address and signature.

DETAILS

  • The UniFi Network 10.6 gateway Rack14-UDMPro logged an IPS attack_response event at Oct 13 06:23:05, reported as CEF by Ubiquiti.
  • Logged action: blocked. Direction: inbound. Threat type: ips.
  • Source is logged as unknown. The log does not give a source IP, port, signature, or CVE.
  • The log names 192.168.1.1 as the threat-detection address. Whether this is the gateway’s own LAN address or the intended target is not stated in the log and is unconfirmed.

IMPACT

  • Confirmed scope is one blocked event on one gateway (Rack14-UDMPro). No other devices or sites are confirmed as affected.
  • Nova’s memory index holds several earlier alerts for similar blocked inbound events on UniFi/UDM-Pro gateways (Oct 4, 5, and 6, 2026), some labeled “Source Unknown” and one referencing a Ubiquiti campaign. These entries are headlines only, with no confirmed details, and are not confirmed as related to this event.
  • Whether the block was effective, and whether any inbound traffic reached an internal service, is not established by the material.

RECOMMENDED ACTIONS

  1. Pull the full IPS event record for 06:23:05 from the UniFi Network console. Record the source IP, destination, port, protocol, and signature ID.
  2. Confirm whether 192.168.1.1 is the gateway’s own LAN address or a host behind it. Check which service, if any, it serves.
  3. Check for port forwards or WAN-exposed services that match the destination port in the event.
  4. Confirm the UDM-Pro firmware and UniFi Network version are current against Ubiquiti’s published advisories. Do not treat this as vulnerable until a specific advisory is matched.
  5. Review gateway logs for additional blocked or allowed inbound events from the same source in the surrounding hours.
  6. If the source IP is identified and repeats, add a firewall block for it and watch for further attempts.

DEVELOPING — monitoring. Source, signature, and target are not yet confirmed. This alert will be updated when the IPS record is reviewed.

SOURCES

  • Ubiquiti UniFi Network 10.6 IPS log, Rack14-UDMPro, Oct 13, 2026 06:23:05 (CEF event, provided as the trigger)
  • Nova memory index: prior alert headlines dated Oct 4–6, 2026 (unverified; headlines only)

Recent high-severity events at publish time:

Recent high-severity events