What is the CVSS score of CVE-2026-77538?

CVE-2026-77538 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of UniFi Connect Application are affected by CVE-2026-77538?

Ubiquiti UniFi Connect Application contains an unauthenticated privilege escalation vulnerability (CVSS 8.2) that allows remote attackers to gain unauthorized administrative access to network…. A patch is available.

How to fix or mitigate CVE-2026-77538?

Within 24 hours: Identify all Ubiquiti UniFi Connect Application instances in your environment and implement network segmentation to restrict administrative interface access to authorized management networks only; enable comprehensive logging and real-time alerting for authentication attempts and privilege escalation events. Within 7 days: Complete a full inventory of UniFi Connect deployments, document all active administrative access, and enable multi-factor authentication on all user accounts; establish daily monitoring dashboards for anomalous access patterns and failed escalation attempts. Within 30 days: Contact Ubiquiti support to confirm patch availability and obtain a deployment timeline; if patches remain unavailable or delayed, implement additional compensating controls such as Web Application Firewall (WAF) rules, network access control lists restricting outbound access, or temporary air-gapping of critical UniFi instances pending vendor resolution.

UniFi Connect Application CVE-2026-77538

EUVD-2026-66365 HIGH

Improper Access Control (CWE-284)

2026-08-26 Ubiquiti

Ubiquiti Authentication Bypass Unifi Connect Application

8.2

CVSS 3.1 · Vendor: Ubiquiti

Severity by source

Vendor (Ubiquiti) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

8.6 HIGH

Network-reachable with no auth; privilege escalation implies incidental confidentiality exposure, warranting C:L over vendor's C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Ubiquiti).

CVSS VectorVendor: Ubiquiti

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Aug 26, 2026 - 11:16 EUVD

Analysis Generated

Aug 26, 2026 - 10:31 vuln.today

CVE Published

Aug 26, 2026 - 09:47 cve.org

HIGH 8.2

DescriptionCVE.org

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to escalate privileges within the UniFi Connect Application.

AnalysisAI

Privilege escalation in Ubiquiti's UniFi Connect Application allows network-accessible unauthenticated attackers to elevate their access level within the application via an Improper Access Control flaw. The vulnerability, tagged as an authentication bypass, exposes access control management infrastructure to unauthorized privilege acquisition with no user interaction or prior credentials required. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify network-exposed UniFi Connect instance

Delivery

Send crafted unauthenticated request

Exploit

Bypass access control enforcement

Execution

Acquire elevated privilege role

Persist

Modify access control policies or credentials

Impact

Gain physical access or disrupt operations

Access

Identify network-exposed UniFi Connect instance

Delivery

Send crafted unauthenticated request

Exploit

Bypass access control enforcement

Execution

Acquire elevated privilege role

Persist

Modify access control policies or credentials

Impact

Gain physical access or disrupt operations

Vulnerability AssessmentAI

Exploitation	The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that exploitation requires only network reachability to the UniFi Connect Application - no authentication, no user interaction, and no special configuration beyond a default deployment are required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) scores 8.2 and indicates a highly exploitable network-reachable flaw requiring no credentials or user interaction, with high integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker with network access to a UniFi Connect Application instance sends a crafted request to an insufficiently protected endpoint, bypassing the application's access control checks. The attacker thereby assumes a higher-privileged role - potentially administrative - within the application. …
Remediation	Consult the Ubiquiti Security Advisory Bulletin 067 at https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9 for the specific patched version of the UniFi Connect Application and apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all Ubiquiti UniFi Connect Application instances in your environment and implement network segmentation to restrict administrative interface access to authorized management networks only; enable comprehensive logging and real-time alerting for authentication attempts and privilege escalation events. …

Threat intelligence, references, and detailed analysis are available after sign-in.