Ubiquiti Patches 21 Critical UniFi Flaws Enabling Full Device Takeover

Ubiquiti has released emergency patches addressing 21 critical-severity vulnerabilities across nearly its entire UniFi product ecosystem, warning that attackers with only network access can chain these flaws to bypass authentication, inject arbitrary commands, and seize full administrative control over routers, surveillance cameras, access-control systems, and cloud gateways. The breadth and severity of this disclosure, which includes multiple CVEs scoring a perfect 10.0 on the CVSS scale, make it one of the most consequential security advisories in the company’s recent history and demand immediate attention from every organization running UniFi infrastructure.

The flaws, tracked under Security Advisory Bulletin 067, arrive just months after Ubiquiti’s earlier Advisory 064 fixed three maximum-severity, actively exploited vulnerabilities in UniFi OS that CISA later added to its Known Exploited Vulnerabilities catalog. That prior episode already signaled that threat actors were actively probing Ubiquiti’s widely deployed platform. This new batch confirms that the attack surface remains broad and inviting, with more than two dozen critical bugs spanning command injection, privilege escalation, and authentication bypass vectors across virtually every product family in the UniFi portfolio.

Twenty-One Critical Flaws Spanning the Full UniFi Product Line

The vulnerabilities affect UniFi Protect Application, UniFi OS Server, UniFi Network Application, UniFi Access Application, UniFi Talk Application, UniFi Connect Application, the UID Enterprise Agent, UniFi Connect Display Cast Pro, UniFi Enterprise Audio/Video Bridge, and the UniFi Protect AI Key. Each carries a CVSS base score between 8.2 and a perfect 10.0, and most require nothing more than network reachability to exploit. This makes unpatched, internet-facing UniFi deployments especially dangerous and likely to attract opportunistic scanning and targeted attacks alike.

Organizations running UniFi hardware on Cloud Keys, Network Video Recorders, NAS units, Dream Machines, Dream Routers, Enterprise Fortress Gateways, Cloud Gateways, Dream Walls, and Express 7 devices all fall within the advisory’s scope. Given the interconnected nature of UniFi’s management plane, a compromise on one device type could provide a pivot point into the broader network, amplifying the risk far beyond any single affected component.

Inside the Command Injection Vulnerabilities: How Attackers Can Execute Arbitrary Code

The bulk of the flaws stem from improper input validation that lets attackers craft specially designed requests to execute arbitrary commands on host devices. Command injection vulnerabilities represent one of the most dangerous classes of software defect because they bypass application-level controls entirely, granting the attacker the same execution privileges as the vulnerable process itself.

PhantomRaven npm Stealer Likely Built Using LLM

该推文得分为4分。 推文内容主要围绕“开源日”庆祝、项目重建进展、邀请用户查看新程序并提供反馈，并预告将推出更多协议功能。虽然提到了“program”和“protocol”，但未明确提及“Solana”或任何Solana相关关键词（如Solana区块链、生态、工具、代币等）。内容属于一般性的开源项目更新，无法判断与Solana有直接关联，因此介于“未提及”和“泛泛提及”之间，但更偏向于缺乏Solana具体信息，故给予4分（处于4-6分档位的最低端，因无明确Solana指代但可能暗指生态内项目）。

Wiz-Led Cloud Security Market Shifts on $32B Google Deal

UniFi Protect Application, the video surveillance backbone used by thousands of businesses and homes to manage IP cameras and recording systems, carries the most severe entries in this category. CVE-2026-77537 scores a perfect 10.0 and requires no privileges whatsoever to exploit. CVE-2026-77533, though slightly less severe on paper, needs only low-level network access. Both are fixed in Protect version 7.2.105. Similar command injection bugs have been patched across UniFi OS Server (fixed in 5.1.37), UniFi Network Application (10.5.67), UniFi Access Application (4.3.5), UniFi Talk Application (5.3.2, which also includes a 10.0-rated flaw), the UID Enterprise Agent (1.62.1), and the UniFi Enterprise Audio/Video Bridge (1.0.11).

Researchers Brandon Rossi and the team at Catchify Security are credited with discovering several of the most severe command injection bugs, alongside independent contributors such as bugbunny.ai and Ben Koo. The variety of reported entry points underscores how input validation failures can recur across different codebases within the same product ecosystem, particularly when separate application teams share common libraries or architectural patterns without centralized security review.

Privilege Escalation and Authentication Bypass: Gaining Full Administrator Control

Beyond command injection, several improper access control flaws allow low-privileged network attackers to escalate their rights to administrator-level control over UniFi OS devices. This category includes Cloud Keys, Network Video Recorders, Dream Machines, Dream Routers, Enterprise Fortress Gateways, and Cloud Gateways. The privilege escalation vulnerabilities are addressed across UniFi OS versions 5.1.31 through 5.1.37 depending on the specific device family, with NAS units requiring version 5.1.32 and the server component reaching 5.1.37.

Two authentication bypass flaws, CVE-2026-77549 and CVE-2026-77550, exploit improper neutralization of CRLF sequences in HTTP responses, allowing attackers on the network to sidestep login controls entirely. CVE-2026-77550 scores a maximum 10.0 and was reported by a trio of researchers at TurtleSec. CRLF injection vulnerabilities are particularly insidious because they can enable HTTP response splitting, cache poisoning, and other attacks that operate below the application layer, making them difficult to detect with standard web application firewalls.

Additional privilege escalation bugs touch the UniFi Connect Application (fixed in 3.24.22), UniFi Connect Display Cast Pro (fixed in 1.0.111), UniFi Access Application (fixed in 4.3.5), and the UniFi Protect AI Key (fixed in 2.2.6), an edge AI module for camera analytics. The Protect AI Key flaw, tracked as CVE-2026-77557, is particularly concerning given that these devices are often deployed at network edges with limited security monitoring.

What Does the Full Advisory Look Like? A Complete Breakdown of Affected Products and Fixes

The table below provides a comprehensive mapping of all 21 CVEs, their affected products, vulnerability types, and the fixed versions that administrators must deploy to secure their infrastructure. This level of detail is essential for IT teams managing heterogeneous UniFi deployments, as patch levels vary by hardware family and software application.

Why These Flaws Are Especially Dangerous: Chaining and Remote Exploitability

What elevates this advisory beyond a routine patch cycle is the chaining potential inherent in the disclosed vulnerabilities. Several of the command injection flaws require no authentication and can be triggered by any device with network access to the targeted UniFi appliance. In combination with the privilege escalation bugs, an attacker who gains a foothold on a single low-privilege account or who simply has network line-of-sight could escalate to full administrator rights, pivot to other UniFi devices, and potentially move laterally into the broader corporate network.

The authentication bypass vulnerabilities (CVE-2026-77549 and CVE-2026-77550) are especially concerning because they completely eliminate the need for valid credentials. An attacker positioned on the same network segment as a vulnerable UniFi OS device can simply sidestep the login page and gain administrative access by manipulating CRLF sequences in HTTP headers. This attack vector does not require phishing, brute force, or stolen credentials, making it difficult to detect with conventional monitoring tools that focus on authentication logs.

Given that Ubiquiti’s UniFi OS has already seen active exploitation earlier in 2026, with CISA adding the Advisory 064 flaws to its Known Exploited Vulnerabilities catalog, security teams should treat these updates as urgent rather than routine. The pattern of researchers finding and reporting critical bugs across multiple product lines suggests that the attack surface is broader than even this 21-flaw disclosure captures, and that continued scrutiny from both independent researchers and threat actors is likely.

What Administrators Must Do Now: Patch Versions and Priority Actions

Ubiquiti is urging all customers to immediately update to the following fixed versions, which address every CVE disclosed in this advisory:

Logitech Options+ flaw lets attackers gain Windows SYSTEM privileges

Three JFrog Artifactory Flaws Exploited for Backdoor Deployment

Check Point VPN Flaws Face Imminent Exploitation

• UniFi Protect Application: 7.2.105
• UniFi OS Server: 5.1.37
• UniFi Network Application: 10.5.67
• UniFi Access Application: 4.3.5
• UniFi Talk Application: 5.3.2
• UniFi Connect Application: 3.24.22
• UID Enterprise Agent: 1.62.1
• UniFi Connect Display Cast Pro: 1.0.111
• UniFi Enterprise Audio/Video Bridge: 1.0.11
• UniFi Protect AI Key: 2.2.6

Organizations running UniFi OS on Cloud Keys, NVRs, NAS units, Dream Machines, or Dream Routers should confirm that their device firmware matches the vendor’s latest builds for each specific hardware family, since patch levels vary by device. The advisory notes, for example, that while the UniFi OS Server component is fixed in 5.1.37, most devices require 5.1.31, NAS units need 5.1.32, and the Express 7 family needs 4.0.17. IT teams should consult the vendor’s release notes for their exact hardware model rather than assuming a one-size-fits-all update.

Given the pattern of chained exploitation seen in prior UniFi advisories, defenders should also isolate management interfaces from the public internet wherever possible. UniFi devices that must remain remotely accessible should be placed behind a VPN or a properly configured reverse proxy, and multi-factor authentication should be enforced on any administrative account that cannot be fully restricted to local network access. Logging and monitoring should be reviewed for signs of anomalous HTTP request patterns, especially those containing unexpected CRLF sequences or unusual header structures that might indicate exploitation attempts against the authentication bypass flaws.

The scale of this disclosure, combined with the active exploitation history of UniFi OS, underscores a broader challenge for the networking industry: as products grow more feature-rich and interconnected, the attack surface expands in ways that are difficult to fully audit. For Ubiquiti, which has built a massive installed base by offering enterprise-grade features at consumer-friendly prices, the challenge is to maintain that value proposition while closing the security gaps that inevitably accompany rapid feature development. For administrators, the lesson is clear: network equipment is no longer a set-and-forget infrastructure layer but a continuously evolving security perimeter that demands the same patch discipline applied to servers, endpoints, and applications.