Ubiquiti has released fixes for 21 critical vulnerabilities in its UniFi line, impacting virtually every major product from routers and cloud gateways to cameras and access-control systems. These flaws allow attackers with only network access to bypass authentication, execute commands remotely, or escalate privileges to full administrator control. The update arrives just months after earlier severe bugs in UniFi OS were patched—some of which were already being exploited in the wild.
Command Injection: Remote Code Execution at the Lowest Level
Most of the newly patched bugs stem from improper input validation, allowing remote actors to inject commands on devices with minimal or no privileges. The UniFi Protect Application is the worst hit: CVE-2026-77537 is rated a full 10.0 severity and requires zero access, while CVE-2026-77533 only needs low-tier network access. Other affected products include UniFi OS Server, UniFi Network Application, UniFi Access, UniFi Talk, the UID Enterprise Agent, and the UniFi Enterprise Audio/Video Bridge—each now patched with the most recent releases.
Privilege Escalation & Login Bypass: Full Admin Control from the Network
Beyond command injection, several access control flaws let attackers escalate from low privilege to full administrative control. Devices running UniFi OS—such as Cloud Keys, Dream Machines, and Cloud Gateways—are especially exposed. Two bugs, CVE-2026-77549 and CVE-2026-77550, allow attackers to bypass login entirely via CRLF injection. Both score the maximum 10.0 severity, underscoring their severity.
What’s Affected & How to Protect Yourself
- UniFi Protect → upgrade to version 7.2.105
- UniFi OS Server → version 5.1.37
- UniFi Network Application → 10.5.67
- UniFi Access → 4.3.5
- UniFi Talk → 5.3.2
- UniFi Connect → 3.24.22
- UID Enterprise Agent → 1.62.1
- Display Cast Pro → 1.0.111
- Enterprise Audio/Video Bridge → 1.0.11
- Protect AI Key → 2.2.6
Firmware versions vary by device family; owners of Cloud Keys, NAS units, Dream Machines/Routers, Fortress Gateways, and similar hardware should confirm they’re on the latest build.
Why This Matters Now
The severity and exploitability of these flaws suggest immediate attention is needed. Every vulnerability in this batch scores between 8.2 and 10.0 on the CVSS scale, and most require just network access to exploit. Given prior advisories have already seen real-world chained exploits involving UniFi devices, delaying this update could quickly lead to compromise.
To defend against these risks, isolate UniFi management interfaces from the open internet where possible, enforce multi-factor authentication for all administrative access, and apply the patches without delay. Organizations should also review logging and intrusion detection settings to spot unusual behavior related to authentication bypass or remote code execution.
Analytical Angle: This massive patch roll-out illustrates how the attack surface of IoT-heavy, integrated networking stacks is multiplying faster than patch cycles can keep up. UniFi’s broad product ecosystem—spanning firmware, applications, cloud agents, AI tools—means a single chain of flaws can pivot access across systems. For network operators and managed service providers, these vulnerabilities are a wake-up call: security isn’t just about perimeter defenses any more—it’s about assumptions of trust within internal networks, rigorous software supply chains, and having visibility into every connected component. Keep an eye on whether Ubiquiti adjusts its disclosure timeline or architecture to reduce the blast radius of future flaws.
