UniFi Protect CVE-2026-77537

The attacker requires network reachability to the UniFi Protect application interface - the description specifies 'a malicious actor with access to the network,' which at minimum means LAN/adjacent access and potentially internet access if the Protect service is exposed via remote access or port-forwarding. No authentication, credentials, user interaction, or non-default configuration is required (AV:N/AC:L/PR:N/UI:N), so default deployments are exploitable once reachable. The primary limiting factor is network position: environments that keep the Protect application off the public internet and behind a segmented management network materially reduce the attack surface, whereas any device with remote access enabled is directly at risk.

This is a genuine top-tier priority, not an inflated high-CVSS artifact. Every CVSS 3.1 metric maximizes risk: AV:N (network reachable), AC:L (no special conditions), PR:N (no authentication), UI:N (no user interaction), and full C:H/I:H/A:H impact with scope change - yielding the ceiling 10.0. The one caveat is that the description says 'a malicious actor with access to the network,' which could imply an adjacent/LAN position rather than true internet-wide reachability; verify exposure of the Protect interface with the vendor. No EPSS score, KEV listing, SSVC decision, or POC was provided, so exploitation-in-the-wild cannot be confirmed and the practical likelihood must be inferred from the vector alone. Given command injection on the host of a commonly internet-exposed surveillance appliance, defenders should treat probability of eventual weaponization as high despite the absence of a current public exploit.

An attacker who can reach the UniFi Protect application over the network sends a crafted request containing shell metacharacters in an improperly validated input field, causing the injected command to execute on the host appliance's operating system. With no authentication or user interaction required (PR:N/UI:N) and low complexity, the attacker gains host-level command execution and can pivot to the surveillance data, tamper with recordings, or use the appliance as a foothold. No public POC was identified at time of analysis.