65
CVEs
38
Critical
26
High
3
KEV
4
PoC
2
Unpatched C/H
96.9%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
38
HIGH
26
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (30)
Ui
52
Unifi Os Server
20
Express 7
19
Dream Wall
12
Dream Machines
12
Cloud Gateways
12
Unifi Network Application
12
Dream Routers
12
Enterprise Fortress Gateway
11
Enterprise Firewall Core
11
Network Video Recorders
11
Cloud Keys
11
Network Attached Storage
10
Udw
8
Udr 5G
8
Unifi Protect Application
8
Udr
8
Udr7
8
Er X Firmware
8
Ucg Ultra
8
Er X Sfp Firmware
8
Efg
8
Udm Pro
8
Ucg Industrial
8
Udm Beast
8
Udm
8
Ucg Fiber
8
Ucg Max
8
Udm Pro Max
8
Udm Se
8
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-34910 | Unauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute arbitrary operating system commands by sending crafted input that bypasses validation. The flaw carries a maximum CVSS 10.0 score with scope change (S:C) impacting confidentiality, integrity, and availability, and affects a broad fleet of UniFi gateways, NVRs, NAS units, and Cloud Keys. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 10.0 | 0.1% | 120 |
KEV
PoC
|
| CVE-2026-34909 | Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlying system, which can then be leveraged to take over an underlying account. The flaw carries a maximum CVSS 10.0 score reflecting unauthenticated network exploitation with scope change and full confidentiality, integrity, and availability impact across a broad fleet of UniFi gateways, cameras, NVRs, and NAS appliances. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. | CRITICAL | 10.0 | 0.0% | 120 |
KEV
PoC
|
| CVE-2026-34908 | Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configuration without authentication, affecting a broad range of UniFi gateways, dream machines, NVRs, NAS units, and cloud keys. The maximum CVSS 10.0 score reflects network-reachable, unauthenticated exploitation with scope change and full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis, but the authentication bypass nature elevates urgency for any UniFi management plane exposed beyond trusted segments. | CRITICAL | 10.0 | 0.0% | 120 |
KEV
PoC
|
| CVE-2026-22557 | A critical path traversal vulnerability exists in the UniFi Network Application that allows unauthenticated remote attackers to access arbitrary files on the underlying system and manipulate them to gain account access. This vulnerability affects Ubiquiti's UniFi Network Application with a maximum CVSS score of 10.0, indicating critical severity with network-based exploitation requiring no user interaction or privileges. The vulnerability was reported through HackerOne, suggesting responsible disclosure, though current exploitation status in the wild is not confirmed. | CRITICAL | 10.0 | 0.0% | 70 |
PoC
No patch
|
| CVE-2026-77554 | Remote command injection in Ubiquiti's UniFi Talk Application lets a network-positioned attacker run arbitrary commands on the underlying host device due to improper input validation (CWE-20). Ubiquiti rates it CVSS 10.0 with a changed scope, meaning a successful attack escapes the application boundary to fully compromise the host. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 10.0 | 1.0% | 51 |
|
| CVE-2026-77537 | Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrary OS commands on the underlying host device, per the CVSS:3.1/AV:N/PR:N/UI:N vector and CWE-20 improper input validation root cause. The maximal 10.0 score reflects full confidentiality, integrity, and availability compromise with a scope change (S:C), meaning code executes on the host beyond the application boundary. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial complexity and lack of authentication make it a top-priority patch for any exposed NVR. | CRITICAL | 10.0 | 0.9% | 51 |
|
| CVE-2026-50746 | Improper access control in Ubiquiti's UniFi Connect Application allows a network-adjacent attacker to bypass authentication and inject arbitrary operating-system commands on the underlying host, yielding full compromise (CVSS 10.0). The flaw chains an access-control weakness (CWE-284) with command injection, so an unauthenticated attacker reachable on the network can execute code with the application's privileges and pivot beyond the app boundary (scope change). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided. | CRITICAL | 10.0 | 0.8% | 51 |
|
| CVE-2026-77533 | Command injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary operating-system commands on the host device (typically a UniFi NVR, Cloud Key, or Dream Machine running the Protect service). The CVSS 3.1 score of 9.9 reflects a scope change: an attacker who already holds a low-privilege application account escapes the application boundary to gain full control of the underlying host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. | CRITICAL | 9.9 | 1.0% | 51 |
|
| CVE-2026-77550 | Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-77543 | Command injection in Ubiquiti's UniFi Access Application allows an authenticated attacker with low privileges and network access to execute arbitrary OS commands on the host device. Rated CVSS 9.9 with a scope change, the flaw stems from improper input validation and lets a low-privileged user break out of the application to compromise the underlying host. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-77546 | OS command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network reach to run arbitrary commands on the underlying host. Because the CVSS scope is marked Changed with full High confidentiality, integrity, and availability impact, successful exploitation moves beyond the application into the host device itself. No public exploit has been identified at time of analysis and the flaw is not on CISA KEV, but the 9.9 severity and low attack complexity make it a top-priority patch. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-77547 | Command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network access to run arbitrary operating-system commands on the underlying host device. The flaw stems from improper input validation (CWE-20) and carries a critical CVSS 9.9 with a scope change, meaning application-level compromise pivots to full control of the host. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-77548 | Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged credentials run arbitrary OS commands on the underlying host device. The CVSS 3.1 base score is 9.9 with a scope change, reflecting that a foothold in the application escalates into full control of the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the near-maximal score and low exploitation barrier make it a high-priority patch. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-50748 | Command injection in Ubiquiti's UniFi Access Application lets a low-privileged attacker with network reach run arbitrary OS commands on the underlying host device, escaping the application into the operating system (CVSS 9.9, scope-changed). Improper input validation (CWE-20) means attacker-supplied data reaches a shell context; there is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. Reported through HackerOne and addressed in Ubiquiti Security Advisory Bulletin 066. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-77552 | Command injection in the Ubiquiti UniFi Enterprise Audio/Video Bridge allows a network-adjacent attacker to run arbitrary operating-system commands on the device by supplying maliciously crafted input that the firmware fails to validate. The CVSS 3.1 base score is 9.8 and the vector marks the flaw as network-reachable with no authentication or user interaction, yielding full confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. | CRITICAL | 9.8 | 0.9% | 50 |
|