UniFi OS Server CVE-2026-77539

Exploitation requires the attacker to hold high privileges (PR:H) on the UniFi OS Server - i.e., an authenticated administrative account - and network access (AV:N) to its management interface; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The concrete prerequisite is administrative control of a UniFi OS Server instance whose management interface is reachable by the attacker. Limiting factors: the requirement for existing admin privileges sharply narrows who can exploit this, and deployments that isolate the management interface behind a VPN/management VLAN further restrict reach; there is no unauthenticated or low-privilege path described in the available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) shows a network-reachable, low-complexity attack requiring no user interaction but demanding high privileges (PR:H) - the attacker must already be an authenticated administrator of the UniFi OS Server. That single factor materially lowers real-world urgency versus the headline 9.1: this is an admin-to-host privilege escalation / sandbox escape, not an unauthenticated takeover. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input; absence of these signals is not evidence of safety but does argue against imminent mass exploitation. The high score is inflated by the scope change and triple-H impact; practically, the population able to exploit it is limited to those who already hold administrative control, so priority should be treated as elevated-but-conditional rather than emergency, weighted by how exposed each deployment's admin plane is.

An attacker who has already obtained administrator credentials for a UniFi OS Server - through phishing, credential reuse, or an insider - logs into the network-accessible management interface and submits a crafted value to an input field that is passed unsanitized into an OS command. The injected payload executes as a command on the host device, giving the attacker a shell beyond the UniFi application and full control of the server. No public exploit is identified, and low attack complexity (AC:L) means that once admin access is held, the crafted request is straightforward to weaponize.