Threat Summary
On August 26, 2026, Ubiquiti officially disclosed three maximum-severity vulnerabilities affecting core UniFi infrastructure: CVE-2026-77537 (UniFi Protect), CVE-2026-77550 (UniFi OS devices), and CVE-2026-77554 (UniFi Talk). Each flaw carries a CVSS v3.1 base score of 10.0 (Critical severity) and enables unauthenticated, remote code execution or authentication bypass, allowing threat actors full control over vulnerable systems. Patches were released by Ubiquiti the same day.
CVE-2026-77537 and CVE-2026-77554 involve improper input validation, and allow command injection in UniFi Protect (up to 7.2.104) and UniFi Talk (versions prior to 5.3.2) applications. A threat actor with network reach can execute arbitrary commands without authenticating.
CVE-2026-77550 is a CRLF (carriage return/line feed) injection in UniFi OS (Server versions prior to 5.1.37; other platforms prior to 5.1.31) permitting remote threat actors to bypass authentication across diverse UniFi platforms (OS Server, Dream Machine, Cloud Key, NVRs, Express 7, etc.).
No authentication or user action is required for exploitation, and devices exposed directly to the internet or untrusted networks should be considered at elevated risk. There is currently no evidence of in-the-wild exploitation or public PoC code for these specific vulnerabilities. Organizations have a critical window to remediate before threat actors take advantage and exploit these flaws.
Recommendations
Immediate Patching:
- Upgrade UniFi Protect Application to version 7.2.105 or later (CVE-2026-77537).
- Upgrade UniFi OS Server to 5.1.37 or later; for Cloud Key, NVR, Dream Machine, Express 7, etc., to 5.1.31+ or vendor-specified fixed versions (CVE-2026-77550).
- Upgrade UniFi Talk Application to version 5.3.2 or later (CVE-2026-77554).
Validate Upgrade Path:
- Verify after updating that software versions match vendor remediation targets.
- Inventory all UniFi devices and components to confirm no vulnerable version remains in production, including backup or standby systems.
Credential Hygiene:
- Rotate all administrative passwords, SSH keys, API tokens for UniFi controllers or network devices after patching.
Long-term Security Improvements:
- Enforce MFA on all management accounts.
- Regularly review patch management and credential policies.
- Enable automatic updates where feasible and enforce least privilege on administrative accounts and management paths.
Temporary Workarounds
- There are no vendor-endorsed workarounds for these vulnerabilities short of full patching.
- Restricting network access to management interfaces (IP allowlisting, isolating on trusted VLANs, or deploying VPN-only management) can reduce risk until updates are applied.
- Temporarily restrict all management interfaces (web/UI/API), especially from untrusted networks or the internet. Favor strong network segmentation (VLANs, VPNs), and firewall rules to limit exposure.
- For internet-exposed devices, immediately disable remote management and apply WAN-side firewall rules to block external access pending patching.
References:
- https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-security-vulnerabilities/
- https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9
- https://opencve.alliance.unm.edu/cve/CVE-2026-77537
- https://opencve.alliance.unm.edu/cve/CVE-2026-77550
- https://opencve.alliance.unm.edu/cve/CVE-2026-77554
