Ubiquiti UniFi: 16 Critical Vulnerabilities Disclosed Together Enable RCE and Auth Bypass
Ubiquiti Inc. disclosed 16 critical vulnerabilities in its UniFi line on August 26, 2026, enabling authentication bypass, command injection, and privilege escalation.
Key findings
- 16 Ubiquiti UniFi vulnerabilities disclosed together on August 26, 2026, with multiple Critical 10.0 CVSSv3 scores.
- Flaws include authentication bypass, command injection, privilege escalation, and remote code execution.
- Affected products span UniFi Access, Protect, OS, Network, and EdgeMAX EdgeSwitches.
- Multiple critical vulnerabilities stem from Improper Input Validation and Improper Access Control.
- A critical buffer overflow in EdgeMAX EdgeSwitches allows RCE for adjacent network attackers.
- Users are urged to update UniFi systems promptly following Ubiquiti's security advisories.
On August 26, 2026, Ubiquiti Inc. disclosed a significant batch of 16 vulnerabilities affecting its UniFi product line, with a tight disclosure window of just two hours. These vulnerabilities, ranging in severity from High to Critical, with multiple receiving the highest CVSSv3 score of 10.0, expose users to risks including authentication bypass, command injection, and privilege escalation. The sheer volume and severity of these flaws highlight a persistent target for researchers and a critical need for prompt patching by users.
Several critical vulnerabilities center on Improper Input Validation, enabling command injection. These include CVE-2026-77548, CVE-2026-77547, CVE-2026-77546, and CVE-2026-77537, all rated Critical with a 9.9 CVSSv3 score, affecting UniFi Protect and UniFi Access Applications. Additionally, CVE-2026-77533, another Critical vulnerability with a 9.9 score, also involves Improper Input Validation in UniFi Protect. High-privilege command injection is possible via Improper Input Validation in CVE-2026-77542 (UID Enterprise Agent, CVSSv3 9.1), CVE-2026-77540 (UniFi OS Server, CVSSv3 9.1), and CVE-2026-77535 (UniFi Network Application, CVSSv3 9.1).
Another significant theme is privilege escalation through Improper Access Control. CVE-2026-77553 (UniFi Access Application, Critical, CVSSv3 9.9) and CVE-2026-77536, CVE-2026-77534 (UniFi OS, Critical, CVSSv3 9.9) allow low-privileged actors to escalate their privileges. CVE-2026-77538, a High severity flaw (CVSSv3 8.2) in UniFi Connect Application, also allows for privilege escalation.
Authentication bypass vulnerabilities were also disclosed, notably CVE-2026-77550 and CVE-2026-77549. Both are rated Critical, with CVE-2026-77550 achieving a perfect 10.0 CVSSv3 score. These vulnerabilities stem from Improper Neutralization of CRLF Sequences in UniFi OS devices, allowing network-accessible attackers to bypass authentication. CVE-2026-77545, an Active Debug Code vulnerability in UniFi OS, also allows for privilege escalation under specific conditions (Critical, CVSSv3 9.0).
A particularly dangerous vulnerability, CVE-2026-77532, is a Critical Buffer Overflow flaw in DHCPv6-enabled EdgeMAX EdgeSwitches, allowing adjacent network attackers to achieve Remote Code Execution with a CVSSv3 score of 9.6.
Ubiquiti addressed these vulnerabilities in security bulletins released on August 26, 2026. While specific patch versions are not detailed for each CVE, the coordinated disclosure suggests that updates were made available concurrently. Users are strongly advised to update their UniFi devices and applications to the latest available versions to mitigate these critical risks. The broad impact across multiple UniFi applications and devices underscores the importance of maintaining up-to-date firmware and software for the entire Ubiquiti ecosystem.
The clustering of 16 vulnerabilities, including multiple with the highest severity ratings, emphasizes the ongoing security challenges within complex network ecosystems like Ubiquiti's UniFi. Users should remain vigilant and prioritize applying security updates as they become available to protect against potential exploitation. The disclosure of these flaws serves as a reminder of the critical need for robust security practices and timely patching in interconnected device environments.
The batch of vulnerabilities disclosed on August 26, 2026, impacts various Ubiquiti UniFi applications and devices. Key themes include command injection via improper input validation, privilege escalation through improper access control, and authentication bypass due to CRLF sequence vulnerabilities. A critical buffer overflow flaw in EdgeMAX EdgeSwitches also enables remote code execution.
Multiple critical vulnerabilities, including CVE-2026-77550 and CVE-2026-77537, achieved the maximum CVSSv3 score of 10.0, enabling severe impacts like authentication bypass and command injection.
The vulnerabilities were disclosed in a tight two-hour window on August 26, 2026, indicating a coordinated research effort or disclosure event.
Privilege escalation is a common impact, facilitated by flaws like Improper Access Control (CVE-2026-77553, CVE-2026-77536, CVE-2026-77534) and Active Debug Code (CVE-2026-77545).
Remote code execution is possible through a critical buffer overflow vulnerability (CVE-2026-77532) in EdgeMAX EdgeSwitches, exploitable by adjacent network attackers.
Ubiquiti has released security advisories addressing these vulnerabilities, urging users to update their systems promptly.
The sheer number and severity of these vulnerabilities highlight the persistent security risks within the Ubiquiti UniFi ecosystem.
CVE-2026-77553, CVE-2026-77550, CVE-2026-77549, CVE-2026-77548, CVE-2026-77547, CVE-2026-77546, CVE-2026-77532, CVE-2026-77545, CVE-2026-77542, CVE-2026-77540, CVE-2026-77538, CVE-2026-77537, CVE-2026-77536, CVE-2026-77535, CVE-2026-77534, CVE-2026-77533