UniFi OS CVE-2026-77536

Exploitation requires the attacker to already hold a low-privilege authenticated foothold on the target (CVSS PR:L) and network reachability to the affected UniFi OS device's management surface (AV:N); no user interaction and no elevated privileges are needed. The limiting factor is that anonymous, fully unauthenticated attackers are not in scope per the vector - some valid low-tier account or credential on the UniFi OS instance is a prerequisite - and the target must be one of the listed UniFi OS device families (UniFi OS Server, Cloud Keys, NVR/Enterprise NVR, Enterprise NAS, Dream Machines/Routers/Wall, Cloud/Enterprise gateways, Enterprise Firewall Core, Enterprise Fortress Gateway, Express 7) running an unpatched version. The specific configuration or role that constitutes 'low privileges' is not detailed in the description and should be confirmed against Ubiquiti's advisory.

The signals point to a genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes a network-reachable, low-complexity attack that needs only low privileges, no user interaction, and results in a scope change with total loss of confidentiality, integrity, and availability. That combination - any authenticated low-tier user pivoting to full device control - is exactly the profile defenders should not defer, and even a mid-sized municipal IT team running a handful of consoles should treat this as urgent given how many services ride on a single UniFi OS host. Tempering that: EPSS is not provided, there is no KEV listing and no known public POC, so exploitation is currently unproven rather than observed - the urgency derives from the vector and the broad affected-device set, not from evidence of in-the-wild activity. One thing to verify with the vendor is the precise privilege boundary crossed: the description says 'escalate privileges within such UniFi OS devices,' and while Ubiquiti scored S:C (scope change), a within-device local admin escalation could arguably be scored S:U, so the 9.9 may be at the conservative-high end of the plausible range.

An attacker who holds a low-privilege UniFi OS account (for example a limited operator, guest-admin, or a compromised low-tier credential) and can reach the device over the network invokes a privileged function or resource that the platform fails to gate, elevating to full administrative control of the console. From there they can alter firewall/network configuration, read stored data or camera footage, and disrupt services. No user interaction is required and complexity is low; no public exploit code is identified at time of analysis.