Ubiquiti has released security updates to address 22 vulnerabilities across its UniFi ecosystem. These updates include multiple critical flaws that could allow unauthenticated command injection, authentication bypass, and privilege escalation on exposed devices.
Documented in Security Advisory Bulletin 067 and published on August 26, 2026, these vulnerabilities affect several components, including UniFi OS, UniFi Protect, UniFi Network, UniFi Access, UniFi Talk, UniFi Connect, UID Enterprise Agent, and various hardware appliances. Most vulnerabilities carry critical CVSS scores, with several rated at 10.0.
Ubiquiti Fixes 22 UniFi Flaws
The most severe issues include CVE-2026-77537, CVE-2026-77550, and CVE-2026-77554, each with a CVSS score of 10.0 and exploitable remotely without authentication or user interaction.
CVE-2026-77537 affects UniFi Protect Application versions 7.1.87 and earlier, allowing command injection on the host device due to improper input validation. Ubiquiti has resolved this flaw in version 7.2.105.
CVE-2026-77550 is an authentication-bypass vulnerability in UniFi OS, resulting from improper handling of CRLF sequences. A remote attacker could exploit this issue to bypass authentication on affected UniFi OS devices or instances.
The affected devices include UniFi OS Server, Cloud Keys, Network Video Recorders, Dream Machines, Cloud Gateways, Dream Routers, Dream Wall, Enterprise Firewall Core, and other appliances.
The bulletin also highlights multiple command-injection flaws in UniFi Protect, UniFi Network, UniFi Access, UniFi Talk, UID Enterprise Agent, UniFi OS Server, and the UniFi Enterprise Audio/Video Bridge.
Successful exploitation could allow an attacker to execute arbitrary commands either on the host system or an adopted device, depending on the specific product affected.
Several vulnerabilities require low-privileged access, making them particularly significant in environments where attackers may already have access to a restricted UniFi account.
For instance, CVE-2026-77533, CVE-2026-77543, CVE-2026-77546, CVE-2026-77547, and CVE-2026-77548 allow low-privileged users to exploit command-injection pathways affecting Protect or Access deployments.
Ubiquiti has also patched privilege escalation flaws in UniFi OS, UniFi Network, UniFi Connect, UniFi Access, UniFi Connect Display Cast Pro, and UniFi Protect AI Key.
Notably, CVE-2026-77538, which affects the UniFi Connect Application, can reportedly be chained with dependency vulnerabilities to escalate privileges on the host device.
CVE Details
| CVE | Vulnerability | Affected product and version | CVSS | Fixed version |
|---|---|---|---|---|
| CVE-2026-77533 | Command injection | UniFi Protect ≤7.1.87 | 9.9 | 7.2.105 |
| CVE-2026-77534 | Privilege escalation | UniFi OS Server ≤5.1.21; devices ≤5.1.26 | 9.9 | Server 5.1.37; devices 5.1.31/5.1.32 |
| CVE-2026-77535 | Command injection | UniFi Network ≤10.4.57 | 9.1 | 10.5.67 |
| CVE-2026-77536 | Privilege escalation | UniFi OS Server ≤5.1.21; devices ≤5.1.26 | 9.9 | Server 5.1.37; devices 5.1.31/5.1.32 |
| CVE-2026-77537 | Unauthenticated command injection | UniFi Protect ≤7.1.87 | 10.0 | 7.2.105 |
| CVE-2026-77538 | Privilege escalation | UniFi Connect ≤3.24.20 | 8.2 | 3.24.22 |
| CVE-2026-77539 | Command injection | UniFi OS Server ≤5.1.21 | 9.1 | 5.1.37 |
| CVE-2026-77540 | Command injection | UniFi OS Server ≤5.1.21 | 9.1 | 5.1.37 |
| CVE-2026-77541 | Privilege escalation | UniFi Network ≤10.4.57 | 9.1 | 10.5.67 |
| CVE-2026-77542 | Command injection | UID Enterprise Agent ≤1.61.8 | 9.1 | 1.62.1 |
| CVE-2026-77543 | Command injection | UniFi Access ≤4.3.3 | 9.9 | 4.3.5 |
| CVE-2026-77545 | Privilege escalation via active debug code | UniFi OS Server/devices | 9.0 | Server 5.1.37; devices 5.1.31/5.1.32 |
| CVE-2026-77546 | Command injection | UniFi Access ≤4.3.3 | 9.9 | 4.3.5 |
| CVE-2026-77547 | Command injection | UniFi Access ≤4.3.3 | 9.9 | 4.3.5 |
| CVE-2026-77548 | Command injection | UniFi Protect ≤7.1.87 | 9.9 | 7.2.105 |
| CVE-2026-77549 | Authentication bypass via CRLF injection | UniFi OS Server/devices; Express ≤4.0.16 | 9.0 | Server 5.1.37; devices 5.1.31/5.1.32; Express 4.0.17 |
| CVE-2026-77550 | Unauthenticated authentication bypass via CRLF injection | UniFi OS Server/devices; Express ≤4.0.16 | 10.0 | Server 5.1.37; devices 5.1.31/5.1.32; Express 4.0.17 |
| CVE-2026-77551 | Privilege escalation | UniFi Connect Display Cast Pro ≤1.0.108 | 9.0 | 1.0.111 |
| CVE-2026-77552 | Unauthenticated command injection | Enterprise Audio/Video Bridge ≤1.0.10 | 9.8 | 1.0.11 |
| CVE-2026-77553 | Privilege escalation | UniFi Access ≤4.3.3 | 9.9 | 4.3.5 |
| CVE-2026-77554 | Unauthenticated command injection | UniFi Talk ≤5.2.7 | 10.0 | 5.3.2 |
| CVE-2026-77557 | Privilege escalation | UniFi Protect AI Key ≤2.1.3 | 9.8 | 2.2.6 |
Organizations should prioritize updates for internet-accessible UniFi management systems, video surveillance deployments, access control infrastructure, and gateway appliances.
Administrators should also restrict management interfaces to trusted networks, review privileged UniFi accounts, and monitor logs for any anomalous administrative activity, unexpected command execution, or suspicious authentication events.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
