Unturned 3.26.3.5 patch fixes RCE exploit from malicious mod

Unturned's 3.26.3.5 patch notes, published July 30, 2026, address a remote code execution (RCE) exploit reported in a malicious server's workshop mod. As a precaution, all Internet server listings were temporarily disabled while the patch was prepared and released, and impact is believed to have been limited to a single small server.

Credit for the find goes to celeb, with a proof-of-concept test case created by Jdance and initially reported through the community Discord. Daniel Willett ran a scan of the past month of workshop uploads to check whether the exploit had been used anywhere else; it had not.

• Loading components with UnityEvents connected to static methods is now prevented. These could be exploited to call restricted methods such as Application.OpenURL; by default, the game filters third-party URLs.

A follow-up patch, 3.26.3.6, was released to fix an error when a component is missing its script during event validation and to ignore events that haven't been configured.

Mods with "missing Item GameObject" (or similar) errors require an update from the mod creator. Until then, certain custom items and objects may be missing from levels and servers.

In reviewed cases, the issue was event-related components referencing a missing target object — for example, an event configured to trigger a particle system that was later removed without updating the event. Code-wise, this is indistinguishable from an attempt to exploit the vulnerability, so it must be blocked.

Modders should check the error log file: above the missing GameObject warning should be a message with the precise component and event causing the issue.