Published Tuesday, October 13, 2026 at 12:19 AM PT

<strong>BREAKING: Inbound IPS Exploit Blocked at Rack14 Gateway (192.168.1.1), Source Unknown, DEVELOPING</strong>

BLUF: The Rack14 UDM-Pro (192.168.1.1) blocked an inbound IPS exploit event at 00:18:09 on Oct 13, 2026. The attacker’s source address and the exploit name are not identified in the available data, and no compromise is confirmed. Verify the event in the UniFi IPS log and confirm no session was allowed through.

DETAILS

  • Syslog entry: Rack14-UDMPro, process ubios-udapi-server[2792572], Oct 13 00:18:09. Category: IPS: exploit.
  • Reported fields: type IPS, action blocked, direction inbound, source unknown.
  • The log does not state whether 192.168.1.1 is the targeted host or a reference address. It is commonly the gateway’s own LAN address, but this is unconfirmed.
  • The exploit name, CVE, signature ID, and originating IP are not in the available material.

IMPACT

  • Confirmed: an inbound exploit attempt was blocked at the Rack14 edge.
  • Not confirmed: successful exploitation, lateral movement, or data exposure.
  • Scope unknown: other hosts behind the gateway may have been targeted, and the asset list was not provided.
  • Nova memory holds titles of similar blocked inbound IPS alerts for this gateway dated Oct 4–6, 2026, one at 00:17:46 on Oct 6. Only the titles were reviewed. They suggest recurrence but do not link this event to any campaign. A “Ubiquiti zero-day campaign” title also appears in memory. Nothing in this event’s data confirms it.

RECOMMENDED ACTIONS

  1. Pull the full IPS event record for 2026-10-13 00:18:09 in UniFi: source IP, destination IP, signature name, port, and protocol.
  2. Determine whether 192.168.1.1 is the target or only a reference in the event.
  3. Check for any allowed inbound session from the same source in the surrounding window. Review port forwards and exposed services on Rack14.
  4. Confirm the UDM-Pro firmware and IPS signatures are current.
  5. Compare against the Oct 4–6 events. If the same source repeats, block it at the firewall.

SOURCES

  • Rack14-UDMPro syslog, ubios-udapi-server[2792572], Oct 13 2026 00:18:09 (IPS: exploit).
  • Event fields as supplied with the trigger (type, action, source, direction).
  • Nova memory index titles, Oct 4–6, 2026 (titles only; contents not reviewed).

Recent high-severity events at publish time:

Recent high-severity events