10 min read
By: RedLegg's Cyber Threat Intelligence Team
About:
Ubiquiti has disclosed three critical vulnerabilities affecting UniFi Protect, UniFi OS devices, and UniFi Talk, each carrying a CVSS score of 10.0.
CVE-2026-77537 and CVE-2026-77554 are unauthenticated command injection vulnerabilities in UniFi Protect and UniFi Talk. An attacker with network access can exploit improper input validation to execute commands on the underlying host device without privileges.
CVE-2026-77550 is a CRLF injection vulnerability affecting multiple UniFi OS devices. Successful exploitation can allow an attacker with network access to bypass authentication without requiring privileges or special conditions.
Ubiquiti has released fixed versions for all three vulnerabilities. There is currently no known exploitation of these vulnerabilities.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
VULNERABILITIES
Unauthenticated Command Injection in UniFi Protect Application
Identifier: CVE-2026-77537
PoC or Exploitation:
No known exploitation at this time.
CVSS Score: 10.0 (Critical, CVSS v3.1)
Update / Patch:
Ubiquiti has released a fixed version addressing this vulnerability.
Affected versions include:UniFi Protect Application, version 7.1.87 and earlier
Fixed versions include:UniFi Protect Application version 7.2.105 or later
Ubiquiti Security Advisory Bulletin 067:
https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9
Description:
CVE-2026-77537 is a command injection vulnerability in the UniFi Protect Application, caused by improper input validation. A malicious actor with access to the network can exploit this flaw to execute commands on the host device. No privileges are required to exploit this vulnerability.
Mitigation Recommendation:
Update UniFi Protect Application to version 7.2.105 or later.
Restrict network access to UniFi Protect management interfaces to trusted networks only.
CRLF Injection Leading to Authentication Bypass in UniFi OS Devices
Identifier: CVE-2026-77550
PoC or Exploitation:
No known exploitation at this time.
CVSS Score: 10.0 (Critical, CVSS v3.1)
Update / Patch:
Ubiquiti has released fixed versions addressing this vulnerability. Multiple device families are affected, each with its own fixed version.
Affected versions include:
UniFi OS Server, version 5.1.21 and earlier
Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall, and Express 7, version 5.1.26 and earlier
Express, version 4.0.16 and earlier
Fixed versions include:
UniFi OS Server: version 5.1.37 or later
Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall, and Express 7: version 5.1.31 or later
Network Attached Storage: version 5.1.32 or later
Express: version 4.0.17 or later
Ubiquiti Security Advisory Bulletin 067:
https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9
Description:
CVE-2026-77550 is a CRLF injection vulnerability affecting devices running UniFi OS. It is caused by improper neutralization of CRLF sequences. A malicious actor with network access can exploit this flaw to bypass authentication on affected UniFi OS devices. No privileges or special conditions are required to exploit this vulnerability.
Mitigation Recommendation:
Update each affected device family to its designated fixed version listed above.
Restrict management-interface access to trusted networks only.
Unauthenticated Command Injection in UniFi Talk Application
Identifier: CVE-2026-77554
PoC or Exploitation:
No known exploitation at this time.
CVSS Score: 10.0 (Critical, CVSS v3.1)
Update / Patch:
Ubiquiti has released a fixed version addressing this vulnerability.
Affected versions include:
UniFi Talk Application, version 5.2.7 and earlier
Fixed versions include:
UniFi Talk Application version 5.3.2 or later
Ubiquiti Security Advisory Bulletin 067:
https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9
Description:
CVE-2026-77554 is a command injection vulnerability in the UniFi Talk Application, caused by improper input validation. A malicious actor with network access can exploit this flaw to execute commands on the host device. No privileges are required to exploit this vulnerability.
Mitigation Recommendation:
Update UniFi Talk Application to version 5.3.2 or later.
Restrict network access to UniFi Talk management interfaces to trusted networks only.
