UniFi Connect Application CVE-2026-77538

The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that exploitation requires only network reachability to the UniFi Connect Application - no authentication, no user interaction, and no special configuration beyond a default deployment are required. The primary limiting factor is network access: if the application's management interface is not exposed beyond a trusted internal network or VLAN, the attack surface is reduced to that network segment. No platform-specific requirement (OS, architecture) is stated. The wildcard CPE suggests all deployed versions are potentially vulnerable, with no safe version boundary identified from available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) scores 8.2 and indicates a highly exploitable network-reachable flaw requiring no credentials or user interaction, with high integrity impact. The PR:N metric is notable: it confirms that exploitation does not require an existing account, which significantly increases the attacker pool. The integrity-only impact (C:N) is consistent with a privilege escalation scenario focused on gaining write or administrative control rather than directly exfiltrating data, though elevated privileges typically enable secondary confidentiality compromises. No EPSS data was provided in the input, and no CISA KEV listing is present, suggesting confirmed widespread exploitation is not yet observed. However, the combination of network accessibility, low complexity, and zero authentication requirement means even a mid-sized municipal IT team in inowroclaw deploying UniFi Connect for physical access control should treat this as urgent - the attack surface is any network-reachable instance. The absence of POC does not meaningfully reduce risk given the low bar for exploitation implied by AC:L/PR:N.

An unauthenticated attacker with network access to a UniFi Connect Application instance sends a crafted request to an insufficiently protected endpoint, bypassing the application's access control checks. The attacker thereby assumes a higher-privileged role - potentially administrative - within the application. With elevated privileges, the attacker could modify access control policies, unlock physical access points, add rogue credentials, or disrupt physical security operations. No public exploit code has been identified at time of analysis, but the low complexity of the attack vector suggests exploitation could be developed quickly.