Ubiquiti Fixes 22 UniFi Flaws Enabling Command Injection, Authentication Bypass and Privilege Escalation

Ubiquiti has released security updates to address 22 vulnerabilities across its UniFi ecosystem. These updates include multiple critical flaws that could allow unauthenticated command injection, authentication bypass, and privilege escalation on exposed devices.

Documented in Security Advisory Bulletin 067 and published on August 26, 2026, these vulnerabilities affect several components, including UniFi OS, UniFi Protect, UniFi Network, UniFi Access, UniFi Talk, UniFi Connect, UID Enterprise Agent, and various hardware appliances. Most vulnerabilities carry critical CVSS scores, with several rated at 10.0.

Ubiquiti Fixes 22 UniFi Flaws

The most severe issues include CVE-2026-77537, CVE-2026-77550, and CVE-2026-77554, each with a CVSS score of 10.0 and exploitable remotely without authentication or user interaction.

CVE-2026-77537 affects UniFi Protect Application versions 7.1.87 and earlier, allowing command injection on the host device due to improper input validation. Ubiquiti has resolved this flaw in version 7.2.105.

CVE-2026-77550 is an authentication-bypass vulnerability in UniFi OS, resulting from improper handling of CRLF sequences. A remote attacker could exploit this issue to bypass authentication on affected UniFi OS devices or instances.

The affected devices include UniFi OS Server, Cloud Keys, Network Video Recorders, Dream Machines, Cloud Gateways, Dream Routers, Dream Wall, Enterprise Firewall Core, and other appliances.

The bulletin also highlights multiple command-injection flaws in UniFi Protect, UniFi Network, UniFi Access, UniFi Talk, UID Enterprise Agent, UniFi OS Server, and the UniFi Enterprise Audio/Video Bridge.

Successful exploitation could allow an attacker to execute arbitrary commands either on the host system or an adopted device, depending on the specific product affected.

Several vulnerabilities require low-privileged access, making them particularly significant in environments where attackers may already have access to a restricted UniFi account.

For instance, CVE-2026-77533, CVE-2026-77543, CVE-2026-77546, CVE-2026-77547, and CVE-2026-77548 allow low-privileged users to exploit command-injection pathways affecting Protect or Access deployments.

Ubiquiti has also patched privilege escalation flaws in UniFi OS, UniFi Network, UniFi Connect, UniFi Access, UniFi Connect Display Cast Pro, and UniFi Protect AI Key.

Notably, CVE-2026-77538, which affects the UniFi Connect Application, can reportedly be chained with dependency vulnerabilities to escalate privileges on the host device.

CVE Details

CVE	Vulnerability	Affected product and version	CVSS	Fixed version
CVE-2026-77533	Command injection	UniFi Protect ≤7.1.87	9.9	7.2.105
CVE-2026-77534	Privilege escalation	UniFi OS Server ≤5.1.21; devices ≤5.1.26	9.9	Server 5.1.37; devices 5.1.31/5.1.32
CVE-2026-77535	Command injection	UniFi Network ≤10.4.57	9.1	10.5.67
CVE-2026-77536	Privilege escalation	UniFi OS Server ≤5.1.21; devices ≤5.1.26	9.9	Server 5.1.37; devices 5.1.31/5.1.32
CVE-2026-77537	Unauthenticated command injection	UniFi Protect ≤7.1.87	10.0	7.2.105
CVE-2026-77538	Privilege escalation	UniFi Connect ≤3.24.20	8.2	3.24.22
CVE-2026-77539	Command injection	UniFi OS Server ≤5.1.21	9.1	5.1.37
CVE-2026-77540	Command injection	UniFi OS Server ≤5.1.21	9.1	5.1.37
CVE-2026-77541	Privilege escalation	UniFi Network ≤10.4.57	9.1	10.5.67
CVE-2026-77542	Command injection	UID Enterprise Agent ≤1.61.8	9.1	1.62.1
CVE-2026-77543	Command injection	UniFi Access ≤4.3.3	9.9	4.3.5
CVE-2026-77545	Privilege escalation via active debug code	UniFi OS Server/devices	9.0	Server 5.1.37; devices 5.1.31/5.1.32
CVE-2026-77546	Command injection	UniFi Access ≤4.3.3	9.9	4.3.5
CVE-2026-77547	Command injection	UniFi Access ≤4.3.3	9.9	4.3.5
CVE-2026-77548	Command injection	UniFi Protect ≤7.1.87	9.9	7.2.105
CVE-2026-77549	Authentication bypass via CRLF injection	UniFi OS Server/devices; Express ≤4.0.16	9.0	Server 5.1.37; devices 5.1.31/5.1.32; Express 4.0.17
CVE-2026-77550	Unauthenticated authentication bypass via CRLF injection	UniFi OS Server/devices; Express ≤4.0.16	10.0	Server 5.1.37; devices 5.1.31/5.1.32; Express 4.0.17
CVE-2026-77551	Privilege escalation	UniFi Connect Display Cast Pro ≤1.0.108	9.0	1.0.111
CVE-2026-77552	Unauthenticated command injection	Enterprise Audio/Video Bridge ≤1.0.10	9.8	1.0.11
CVE-2026-77553	Privilege escalation	UniFi Access ≤4.3.3	9.9	4.3.5
CVE-2026-77554	Unauthenticated command injection	UniFi Talk ≤5.2.7	10.0	5.3.2
CVE-2026-77557	Privilege escalation	UniFi Protect AI Key ≤2.1.3	9.8	2.2.6

Organizations should prioritize updates for internet-accessible UniFi management systems, video surveillance deployments, access control infrastructure, and gateway appliances.

Administrators should also restrict management interfaces to trusted networks, review privileged UniFi accounts, and monitor logs for any anomalous administrative activity, unexpected command execution, or suspicious authentication events.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC