23
CVEs
22
Critical
1
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.6%
Avg EPSS
Severity Breakdown
CRITICAL
22
HIGH
1
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Unifi Os Server
20
Express 7
19
Dream Machines
12
Cloud Gateways
12
Dream Wall
12
Dream Routers
12
Enterprise Firewall Core
11
Cloud Keys
11
Network Video Recorders
11
Enterprise Fortress Gateway
11
Network Attached Storage
10
Udr 5G
8
Udw
8
Udm Pro Max
8
Ucg Ultra
8
Unifi Protect Application
8
Ucg Max
8
Unifi Network Application
8
Udr7
8
Ucg Fiber
8
Udm Beast
8
Udm
8
Udr
8
Udm Pro
8
Efg
8
Ucg Industrial
8
Udm Se
8
Unas Pro
7
Unas Pro 8
7
Unvr G2
7
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-77554 | Remote command injection in Ubiquiti's UniFi Talk Application lets a network-positioned attacker run arbitrary commands on the underlying host device due to improper input validation (CWE-20). Ubiquiti rates it CVSS 10.0 with a changed scope, meaning a successful attack escapes the application boundary to fully compromise the host. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 10.0 | 1.0% | 51 |
|
| CVE-2026-77537 | Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrary OS commands on the underlying host device, per the CVSS:3.1/AV:N/PR:N/UI:N vector and CWE-20 improper input validation root cause. The maximal 10.0 score reflects full confidentiality, integrity, and availability compromise with a scope change (S:C), meaning code executes on the host beyond the application boundary. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial complexity and lack of authentication make it a top-priority patch for any exposed NVR. | CRITICAL | 10.0 | 0.9% | 51 |
|
| CVE-2026-77533 | Command injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary operating-system commands on the host device (typically a UniFi NVR, Cloud Key, or Dream Machine running the Protect service). The CVSS 3.1 score of 9.9 reflects a scope change: an attacker who already holds a low-privilege application account escapes the application boundary to gain full control of the underlying host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. | CRITICAL | 9.9 | 1.0% | 51 |
|
| CVE-2026-77550 | Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-77543 | Command injection in Ubiquiti's UniFi Access Application allows an authenticated attacker with low privileges and network access to execute arbitrary OS commands on the host device. Rated CVSS 9.9 with a scope change, the flaw stems from improper input validation and lets a low-privileged user break out of the application to compromise the underlying host. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-77546 | OS command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network reach to run arbitrary commands on the underlying host. Because the CVSS scope is marked Changed with full High confidentiality, integrity, and availability impact, successful exploitation moves beyond the application into the host device itself. No public exploit has been identified at time of analysis and the flaw is not on CISA KEV, but the 9.9 severity and low attack complexity make it a top-priority patch. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-77547 | Command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network access to run arbitrary operating-system commands on the underlying host device. The flaw stems from improper input validation (CWE-20) and carries a critical CVSS 9.9 with a scope change, meaning application-level compromise pivots to full control of the host. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-77548 | Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged credentials run arbitrary OS commands on the underlying host device. The CVSS 3.1 base score is 9.9 with a scope change, reflecting that a foothold in the application escalates into full control of the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the near-maximal score and low exploitation barrier make it a high-priority patch. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-77552 | Command injection in the Ubiquiti UniFi Enterprise Audio/Video Bridge allows a network-adjacent attacker to run arbitrary operating-system commands on the device by supplying maliciously crafted input that the firmware fails to validate. The CVSS 3.1 base score is 9.8 and the vector marks the flaw as network-reachable with no authentication or user interaction, yielding full confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. | CRITICAL | 9.8 | 0.9% | 50 |
|
| CVE-2026-77534 | Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to elevate to higher privileges on the affected device or instance due to an improper access control flaw. The issue spans Ubiquiti's core managed platforms - UniFi OS Server, Cloud Keys, Dream Machines/Routers, Cloud Gateways, NVR/Enterprise NVR, Enterprise NAS, and Enterprise Firewall/Fortress Gateway - and carries a critical CVSS 9.9 with a changed scope. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make it high priority. | CRITICAL | 9.9 | 0.2% | 50 |
|
| CVE-2026-77536 | Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate their rights to full administrative control, per Ubiquiti Security Advisory Bulletin 067 (CVE-2026-77536). The flaw stems from improper access control (CWE-284) and carries a near-maximum CVSS 9.9 due to a scope-changing impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.2% | 50 |
|
| CVE-2026-77553 | Privilege escalation in Ubiquiti's UniFi Access Application allows a network-adjacent attacker holding only low-privilege credentials to gain full control of the underlying host device through an improper access control flaw. Ubiquiti self-reported the issue and rates it CVSS 9.9 (scope-changing), reflecting that a constrained application account can break out to compromise the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.2% | 50 |
|
| CVE-2026-77557 | Privilege escalation in Ubiquiti's UniFi Protect AI Key lets a network-adjacent attacker abuse an improper access control (authentication-bypass) weakness to gain elevated privileges on the device, per Ubiquiti's own advisory (Security Advisory Bulletin 067). The CVSS 9.8 rating reflects a network-reachable, no-authentication, no-interaction path yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-77532 | Remote code execution in Ubiquiti EdgeMAX EdgeSwitch devices allows an attacker on an adjacent network to fully compromise the switch by exploiting a heap-based buffer overflow in its DHCPv6 handling. The flaw affects EdgeSwitch units that have DHCPv6 enabled and requires no authentication or user interaction, only Layer 2/link-local reachability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.6 rating and network-daemon attack surface make it a high-priority patching target. | CRITICAL | 9.6 | 0.3% | 48 |
|
| CVE-2026-77535 | Authenticated command injection in Ubiquiti's UniFi Network Application (the controller software managing UniFi network gear) allows an attacker holding high-privilege access on the network to inject and execute operating-system commands on an adopted device managed by the controller. Because the injected command runs on a downstream device rather than the controller itself, the flaw crosses a trust boundary (CVSS scope change) and yields full confidentiality, integrity, and availability impact on the target device. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.1 | 0.8% | 46 |
|