Ubiquiti Patches 21 Critical UniFi Flaws, Including Authentication Bypass and Command Injection
Ubiquiti has addressed 21 critical vulnerabilities across its UniFi product line, enabling attackers to bypass authentication, inject commands, and escalate privileges.
Ubiquiti has released patches for a significant security issue, addressing 21 critical vulnerabilities that affect a wide range of its UniFi products. These flaws, if exploited, could allow attackers with only network access to bypass authentication, execute arbitrary commands, and gain administrative control over devices such as routers, cameras, and access control systems. This new batch of disclosures highlights the ongoing security challenges within Ubiquiti's extensive ecosystem, which serves both home users and large enterprises.
The majority of these vulnerabilities stem from improper input validation, a common weakness that enables attackers to inject and execute malicious commands on affected devices. Notably, the UniFi Protect Application, used for video surveillance, is impacted by several severe command injection flaws, including CVE-2026-77537, which carries a perfect CVSS score of 10.0 and requires no prior privileges. Similar command injection vulnerabilities have been identified and patched in UniFi OS Server, UniFi Network Application, UniFi Access Application, UniFi Talk Application, and the UID Enterprise Agent, among others.
Beyond command injection, the security update also rectifies improper access control vulnerabilities. These flaws allow low-privileged network attackers to escalate their privileges to administrator-level control over various UniFi OS devices, including Cloud Keys, Network Video Recorders, and Dream Machines. Two critical authentication bypass vulnerabilities, CVE-2026-77549 and CVE-2026-77550, exploit improper handling of CRLF sequences, enabling attackers to circumvent login mechanisms entirely. CVE-2026-77550 also boasts a perfect CVSS score of 10.0.
Researchers from Catchify Security, alongside independent contributors like Brandon Rossi, bugbunny.ai, and Ben Koo, are credited with discovering many of these critical issues. The TurtleSec team also played a role in identifying the authentication bypass flaws. The comprehensive list of affected products includes UniFi Protect, UniFi OS, UniFi Network Application, UniFi Access Application, UID Enterprise Agent, UniFi Connect Application, UniFi Talk Application, and UniFi Enterprise Audio/Video Bridge, among others.
Ubiquiti has provided specific version numbers for both the affected software and the patched releases. For instance, UniFi Protect Application versions prior to 7.2.105 are vulnerable, while UniFi OS Server versions prior to 5.1.37 have been patched. Users are strongly advised to update their UniFi devices to the latest available firmware to mitigate these risks. The company's advisory details the specific fixes for each affected product, emphasizing the need for prompt action.
The severity of these vulnerabilities is underscored by their CVSS base scores, which range from 8.2 to a perfect 10.0. The fact that most of these flaws can be exploited with only network access makes unpatched, internet-facing UniFi deployments particularly vulnerable. This situation is especially concerning given that Ubiquiti's UniFi OS has previously been targeted by active exploitation campaigns.
This extensive disclosure of critical vulnerabilities serves as a stark reminder of the importance of continuous security monitoring and timely patching for network infrastructure devices. Organizations relying on Ubiquiti's UniFi ecosystem should prioritize updating their systems to the latest secure versions to protect against potential compromise. The company's proactive patching efforts, while extensive, highlight the persistent threat landscape faced by connected devices.
Given the widespread use of UniFi products in both small and large networks, the potential impact of these vulnerabilities is significant. Attackers could gain deep access into networks, potentially leading to data breaches, service disruptions, or further lateral movement within compromised environments. The combination of authentication bypass, command injection, and privilege escalation capabilities makes these flaws particularly dangerous.
This new report specifies that three of the patched vulnerabilities received a maximum CVSS score of 10.0, identifying CVE-2026-77537, CVE-2026-77550, and CVE-2026-77554 as critical flaws allowing privilege escalation through improper access control. The article also notes that Ubiquiti has now disclosed a total of three maximum-severity vulnerabilities this year, matching the number patched in the previous months combined.