UniFi OS Server CVE-2026-77540

Exploitation requires the attacker to already hold high-privilege (administrative) access to the UniFi OS Server (CVSS PR:H) and network reachability to its management interface (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factor is therefore authentication and authorization: this is not exploitable by an unauthenticated or low-privileged attacker, so it functions as a host-breakout/privilege-boundary bypass usable by a legitimate-but-malicious admin or by an attacker who has previously compromised admin credentials. Segmenting or restricting who can reach the management plane and who holds admin rights directly gates realistic exploitation.

The signals are mixed. CVSS is 9.1 (Critical) driven by network vector (AV:N), low complexity (AC:L), no user interaction (UI:N), scope change (S:C), and full C/I/A impact - but the PR:H requirement is the decisive limiter: an attacker must already hold high-privilege (administrative) access to the UniFi OS Server before this becomes exploitable. That downgrades it from a pre-auth internet worm risk to a privilege-escalation / host-takeover primitive useful to an insider or to an attacker who has already compromised admin credentials. There is no CISA KEV listing and no public POC referenced, and EPSS was not provided, so there is no evidence of active or widespread exploitation; the practical priority hinges on how exposed and how well-segmented each operator's management plane is, and a mid-sized municipal IT team in radom running an internet-reachable UniFi OS Server with shared admin credentials should still patch promptly. Net: treat as a high-priority patch for any deployment where admin access is broadly held or the management interface is exposed, but not an emergency drop-everything issue for well-segmented, tightly-administered installations.

An attacker who has obtained high-privilege administrative access to a UniFi OS Server - for example via reused or phished admin credentials, or a malicious insider - submits crafted input to a management function that is passed unsanitized into a host command, injecting attacker-controlled OS commands. Because the process can act on the host, the injected command runs with host-service privileges, giving the attacker code execution and full control of the device. No public POC is referenced, and low attack complexity (AC:L) means exploitation is straightforward once the privilege prerequisite is met.