Ubiquiti Patched 22 UniFi Flaws. Three Need No Login and Score 10.0.
Ubiquiti has patched 22 vulnerabilities across the UniFi platform. Three score 10.0 and require no authentication, while several more let low-privileged users inject commands or escalate control across network, access, video, voice and edge devices.
The number is important, but the architecture matters more. Ubiquiti Security Advisory Bulletin 067 covers the software that administers networks, doors, cameras, telephones, displays, storage and appliance operating systems. A weakness in one of those management planes can cross from an application into the host or into devices that organisations normally treat as trusted infrastructure.
Three flaws stand out immediately: CVE-2026-77537 in UniFi Protect, CVE-2026-77550 in UniFi OS and CVE-2026-77554 in UniFi Talk. Each carries a CVSS score of 10.0 and can be reached over the network without a login or user interaction.
The three maximum-severity flaws
- CVE-2026-77537, UniFi Protect: unauthenticated command injection caused by improper input validation. Update to Protect 7.2.105 or later.
- CVE-2026-77550, UniFi OS: a low-complexity CRLF injection can bypass authentication. Update the affected appliance or UniFi OS Server to the fixed release listed by Ubiquiti.
- CVE-2026-77554, UniFi Talk: unauthenticated command injection in the voice platform. Update to Talk 5.3.2 or later.
Ubiquiti has not reported malicious exploitation of these three vulnerabilities, and BlackTree found no credible public proof of concept at the time of writing. That is not the same as low risk. The vulnerable products are network-reachable, the attack paths do not need credentials, and public reporting notes that exposure data includes more than 100,000 UniFi OS instances. That figure is an exposure estimate, not a count of vulnerable or compromised systems.
Every vulnerability in Bulletin 067
The bulletin is broader than the three headline flaws. Security teams should evaluate all 22 CVEs separately because authentication requirements, affected components and fixed versions differ.
| CVE | Product and impact | Prerequisite | Fixed version |
|---|---|---|---|
| CVE-2026-77533 | Protect command injection, CVSS 9.9 | Network access and low privileges | Protect 7.2.105 |
| CVE-2026-77534 | UniFi OS privilege escalation, 9.9 | Network access and low privileges | OS Server 5.1.37; appliances 5.1.31; NAS 5.1.32 |
| CVE-2026-77535 | Network application command injection, 9.1 | Network access and high privileges | Network 10.5.67 |
| CVE-2026-77536 | UniFi OS privilege escalation, 9.9 | Network access and low privileges | OS Server 5.1.37; appliances 5.1.31; NAS 5.1.32 |
| CVE-2026-77537 | Protect command injection, 10.0 | No authentication | Protect 7.2.105 |
| CVE-2026-77538 | Connect privilege escalation, 8.2; may chain with dependency issues into host escalation | No authentication | Connect 3.24.22 |
| CVE-2026-77539 | OS Server command injection, 9.1 | Network access and high privileges | OS Server 5.1.37 |
| CVE-2026-77540 | OS Server command injection, 9.1 | Network access and high privileges | OS Server 5.1.37 |
| CVE-2026-77541 | Network application privilege escalation, 9.1 | Network access and high privileges | Network 10.5.67 |
| CVE-2026-77542 | UID Enterprise Agent command injection, 9.1 | Network access and high privileges | UID Enterprise Agent 1.62.1 |
| CVE-2026-77543 | Access command injection, 9.9 | Network access and low privileges | Access 4.3.5 |
| CVE-2026-77545 | Privilege escalation through active debug code, 9.0 | Network access, low privileges and an additional condition | OS Server 5.1.37; appliances 5.1.31; NAS 5.1.32 |
| CVE-2026-77546 | Access command injection, 9.9 | Network access and low privileges | Access 4.3.5 |
| CVE-2026-77547 | Access command injection, 9.9 | Network access and low privileges | Access 4.3.5 |
| CVE-2026-77548 | Protect command injection, 9.9 | Network access and low privileges | Protect 7.2.105 |
| CVE-2026-77549 | CRLF injection leading to authentication bypass, 9.0 | No authentication, but higher complexity or an additional condition | OS Server 5.1.37; appliances 5.1.31; NAS 5.1.32; UniFi Express 4.0.17 |
| CVE-2026-77550 | CRLF injection leading to authentication bypass, 10.0 | No authentication | OS Server 5.1.37; appliances 5.1.31; NAS 5.1.32; UniFi Express 4.0.17 |
| CVE-2026-77551 | Connect Display Cast Pro privilege escalation, 9.0 | No authentication, higher complexity | Display Cast Pro 1.0.111 |
| CVE-2026-77552 | Enterprise Audio/Video Bridge command injection, 9.8 | No authentication | Bridge 1.0.11 |
| CVE-2026-77553 | Access privilege escalation, 9.9 | Network access and low privileges | Access 4.3.5 |
| CVE-2026-77554 | Talk command injection, 10.0 | No authentication | Talk 5.3.2 |
| CVE-2026-77557 | Protect AI Key privilege escalation, 9.8 | No authentication | AI Key 2.2.6 |
CVE-2026-77544 is not listed in Bulletin 067. The numerical gap should not be mistaken for an omitted row in Ubiquiti’s advisory.
The version guidance needs careful reading
The Canadian Centre for Cyber Security alert usefully identifies affected product branches, including UniFi OS Server 5.1.21 and earlier, Connect 3.24.20 and earlier, Network 10.4.57 and earlier, UID Enterprise Agent 1.61.8 and earlier, Access 4.3.3 and earlier, Protect 7.1.87 and earlier, Talk 5.2.7 and earlier and several hardware-specific releases.
Those affected-version ceilings are not the same thing as the fixed builds. Administrators should follow Ubiquiti’s product-by-product update matrix, not infer that the next minor number is sufficient. Appliance families do not all share the same operating-system build, and UniFi Express has its own fixed version for the CRLF authentication-bypass flaws.
What defenders should do now
- Inventory every UniFi role. Include consoles, self-hosted servers, gateways, access-control appliances, cameras, AI Keys, bridges, displays, telephony and NAS devices.
- Prioritise unauthenticated paths. Patch Protect, Talk, UniFi OS, the Enterprise Audio/Video Bridge and Protect AI Key before treating the bulletin as routine application maintenance.
- Verify running builds after the update. A management console can report an intended release while an appliance or application remains on an older image.
- Restrict exposure. Remove direct Internet reachability where it is not required and limit management and application access to trusted networks.
- Review for pre-patch activity. Look for unexpected authentication events, configuration changes, child processes, command execution, new accounts and unusual outbound connections.
- Do not wait for a public exploit. Ubiquiti provides updates rather than a compensating workaround. Reproducible exploit code or confirmed malicious use would shorten the window further, but the present trust-boundary failures already justify urgent remediation.
The larger security lesson
UniFi is attractive because it brings many infrastructure functions into one operating model. Bulletin 067 shows the other side of that consolidation. A single vendor update can contain weaknesses spanning identity, command execution and privilege boundaries across physical security, voice, video and networking.
The right response is not to count CVEs and stop at the three 10.0 scores. It is to map each vulnerable component to the authority it holds. A camera controller, door-access application or network console can become an attacker route into systems far more consequential than the application where the bug began.
Update, 1 September 2026: Bulletin 067 was not UniFi’s first CVSS 10 emergency
The 22 flaws in Bulletin 067 arrived after Ubiquiti had already patched a separate trio of maximum-severity UniFi OS vulnerabilities in Security Advisory Bulletin 064. CISA added all three to its Known Exploited Vulnerabilities catalogue on 23 June.
- CVE-2026-34908 can let a network attacker make unauthorised system changes.
- CVE-2026-34909 is a path-traversal flaw that can expose underlying files and contribute to account access.
- CVE-2026-34910 is an input-validation flaw that can lead to command injection. Public reporting links exploitation to Mirai botnet activity.
The affected and fixed branches differ by UniFi OS platform, so administrators should follow Bulletin 064’s appliance-specific release table rather than infer one universal version. Systems exposed before the update need compromise review, including configuration changes, new accounts, unexpected processes and outbound botnet traffic.
Primary sources: Ubiquiti Security Advisory Bulletin 064 and the CISA KEV catalogue.
Sources and publication details
- Ubiquiti Security Advisory Bulletin 067, published 26 August 2026. The primary source provides a date but no publication time.
- Canadian Centre for Cyber Security, AV26-850, published and last modified 26 August 2026. No publication time was provided.
- BleepingComputer: Ubiquiti patches three max-severity vulnerabilities, published 26 August 2026 at 09:17. The page does not state a timezone.
