Unturned’s developers got word of a remote code execution exploit hidden in a workshop mod hosted by a malicious server, and they did not wait around. Every Internet server listing was switched off as a precaution while the fix was written and pushed. By the team’s own assessment, the damage stayed contained to one small server.
The result was patch 3.26.3.5, followed by 3.26.3.6, which cleaned up an error thrown when a component had no script during event validation and told the game to ignore events that were never configured in the first place.
The exploit itself
The hole sat in components whose UnityEvents were wired to static methods. That wiring let mod content reach code it had no business touching — restricted calls including engine-level URL opening, even though the game normally filters third-party links. The fix is blunt and effective: components with events pointing at static methods no longer load at all.
Credit is spread around in the announcement. celeb reported the issue. Jdance put together a proof-of-concept test case, which initially came in through the community Discord, and Daniel Willett swept a month’s worth of workshop uploads to see whether anyone else had abused the trick. Nothing turned up.
The collateral damage
Since the patch, some mods started throwing “missing Item GameObject” style errors, and custom items and objects simply stopped appearing on some maps and servers. This is not sabotage — it is old, sloppy wiring. In the cases the team examined, an event pointed at a target object that had since been deleted: a trigger set up to fire a particle system, for instance, that outlived the particle system itself.
From the engine’s perspective that dangling reference looks identical to someone probing the vulnerability, so it gets blocked alongside real attacks. Only the mod author can resolve it with an update. Modders are told to read the error log: the line above the missing GameObject warning names the exact component and event responsible.
Why this is more than a routine hotfix
Killing server listings across the board is not something a team does often, and the announcement frames it plainly as a precaution taken while the patch was being prepared, with the impact believed to be limited to a single small server. In a game where the workshop defines what most servers even look like, tightening content validation is a logical move — and breaking a slice of legacy mods was the price.
What this means for players using software
Nothing here touches anti-cheat. The changes live entirely in mod content validation. What matters instead is mechanical: two client builds shipped back to back, and every Unturned build recompiles the binary and shifts the addresses external tools rely on.
- Do not load in immediately after the update. Check the software update statuses first. A tool flagged as pending an update will either crash the client or leave you with ESP boxes drawn at stale coordinates.
- Turn off Steam auto-updates for Unturned if you run external tooling. Ending up on 3.26.3.6 while your loader targets 3.26.3.5 is the single most common cause of “it just stopped working.”
- Expect a different world. Where custom items and objects have vanished from a server, that loot and cover is genuinely gone, not merely unrendered — read your overlay accordingly instead of assuming the tool is broken.
- Note where the actual risk came from. This RCE arrived through a mod on a hostile server, not through cheat software. Sketchy servers and unvetted workshop content remain the main threat to your machine and your account, which is an argument for a dedicated account and sensible HWID hygiene rather than for trusting random hosts.
Builds confirmed against the current game version are listed on the Unturned software page, including which features have already been retested after the patch.
Dominate Unturned with our software
Verified cheats and software — updates within 12–48 hours after major patches, with guarantees and 24/7 support.