Ubiquiti Patches 22 Vulnerabilities Across UniFi Ecosystem, Including Three Max-Severity Flaws
Ubiquiti released a major security advisory addressing 22 vulnerabilities across nearly its entire product stack. The impacted software includes UniFi Protect, UniFi Network, UniFi Access, UniFi Talk, UniFi Connect, and the core UniFi OS platform. Out of the 22 addressed flaws, 21 carry a critical severity rating, with three vulnerabilities scoring a maximum CVSS rating of 10.0. Specifically, CVE-2026-77537 enables unauthenticated network attackers to execute arbitrary commands on the UniFi Protect host due to poor input validation. A related unauthenticated command injection bug, tracked as CVE-2026-77554, affects the UniFi Talk application. For the underlying operating platform, CVE-2026-77550 allows attackers to bypass authentication on UniFi OS instances via improper neutralization of CRLF sequences. Another notable vulnerability, CVE-2026-77545, carries a 9.0 CVSS score and stems from leftover active debugging code in UniFi OS. Additionally, CVE-2026-77549 presents another authentication bypass condition linked to CRLF handling. Ubiquiti indicated that these bugs are easily exploitable across local or remote networks without user interaction, though active in-the-wild exploitation was not confirmed prior to patch publication. Fixed software releases have been deployed across all affected product lines, requiring administrators to update to versions such as UniFi Network Application 10.5.67 and UniFi OS Server 5.1.37.
Commentary
Ubiquiti appliances occupy a critical position in modern infrastructure, acting as the management bridge between edge routing, physical access control, video surveillance, and telephony. When an authentication bypass like `CVE-2026-77550` or remote command injection like `CVE-2026-77537` lands in network-exposed appliances, attackers gain an immediate stepping stone into segmented internal zones. With roughly 100,000 UniFi OS management endpoints directly visible to search engines like Censys, automated scanning and mass exploitation are inevitable. The proper response is immediate patching across all application modules—specifically pulling UniFi Network to `10.5.67+`, UniFi Protect to `7.2.105+`, and the underlying UniFi OS Server to `5.1.37+`. Furthermore, administrator interfaces for these controllers must be pulled off public IP addresses entirely, isolated onto dedicated management VLANs, and placed behind an authenticated reverse proxy or WireGuard/IPsec tunnel rather than exposing the default web ports.
The Quote to Remember
“A malicious actor with network access and fulfilling certain conditions could exploit a vulnerability related to incorrect neutralization of CRLF sequences, present in certain devices running UniFi OS, in order to bypass authentication on these devices or UniFi OS instances.”