46
CVEs
27
Critical
18
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
27
HIGH
18
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (30)
Ui
52
Unifi Os Server
20
Express 7
19
Dream Wall
12
Dream Machines
12
Cloud Gateways
12
Unifi Network Application
12
Dream Routers
12
Enterprise Fortress Gateway
11
Enterprise Firewall Core
11
Network Video Recorders
11
Cloud Keys
11
Network Attached Storage
10
Udw
8
Udr 5G
8
Unifi Protect Application
8
Udr
8
Udr7
8
Er X Firmware
8
Ucg Ultra
8
Er X Sfp Firmware
8
Efg
8
Udm Pro
8
Ucg Industrial
8
Udm Beast
8
Udm
8
Ucg Fiber
8
Ucg Max
8
Udm Pro Max
8
Udm Se
8
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-77554 | Remote command injection in Ubiquiti's UniFi Talk Application lets a network-positioned attacker run arbitrary commands on the underlying host device due to improper input validation (CWE-20). Ubiquiti rates it CVSS 10.0 with a changed scope, meaning a successful attack escapes the application boundary to fully compromise the host. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 10.0 | 1.0% | 51 |
|
| CVE-2026-77537 | Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrary OS commands on the underlying host device, per the CVSS:3.1/AV:N/PR:N/UI:N vector and CWE-20 improper input validation root cause. The maximal 10.0 score reflects full confidentiality, integrity, and availability compromise with a scope change (S:C), meaning code executes on the host beyond the application boundary. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial complexity and lack of authentication make it a top-priority patch for any exposed NVR. | CRITICAL | 10.0 | 0.9% | 51 |
|
| CVE-2026-50746 | Improper access control in Ubiquiti's UniFi Connect Application allows a network-adjacent attacker to bypass authentication and inject arbitrary operating-system commands on the underlying host, yielding full compromise (CVSS 10.0). The flaw chains an access-control weakness (CWE-284) with command injection, so an unauthenticated attacker reachable on the network can execute code with the application's privileges and pivot beyond the app boundary (scope change). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided. | CRITICAL | 10.0 | 0.8% | 51 |
|
| CVE-2026-77533 | Command injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary operating-system commands on the host device (typically a UniFi NVR, Cloud Key, or Dream Machine running the Protect service). The CVSS 3.1 score of 9.9 reflects a scope change: an attacker who already holds a low-privilege application account escapes the application boundary to gain full control of the underlying host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. | CRITICAL | 9.9 | 1.0% | 51 |
|
| CVE-2026-77550 | Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-77543 | Command injection in Ubiquiti's UniFi Access Application allows an authenticated attacker with low privileges and network access to execute arbitrary OS commands on the host device. Rated CVSS 9.9 with a scope change, the flaw stems from improper input validation and lets a low-privileged user break out of the application to compromise the underlying host. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-77546 | OS command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network reach to run arbitrary commands on the underlying host. Because the CVSS scope is marked Changed with full High confidentiality, integrity, and availability impact, successful exploitation moves beyond the application into the host device itself. No public exploit has been identified at time of analysis and the flaw is not on CISA KEV, but the 9.9 severity and low attack complexity make it a top-priority patch. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-77547 | Command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network access to run arbitrary operating-system commands on the underlying host device. The flaw stems from improper input validation (CWE-20) and carries a critical CVSS 9.9 with a scope change, meaning application-level compromise pivots to full control of the host. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-77548 | Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged credentials run arbitrary OS commands on the underlying host device. The CVSS 3.1 base score is 9.9 with a scope change, reflecting that a foothold in the application escalates into full control of the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the near-maximal score and low exploitation barrier make it a high-priority patch. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-50748 | Command injection in Ubiquiti's UniFi Access Application lets a low-privileged attacker with network reach run arbitrary OS commands on the underlying host device, escaping the application into the operating system (CVSS 9.9, scope-changed). Improper input validation (CWE-20) means attacker-supplied data reaches a shell context; there is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. Reported through HackerOne and addressed in Ubiquiti Security Advisory Bulletin 066. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-77552 | Command injection in the Ubiquiti UniFi Enterprise Audio/Video Bridge allows a network-adjacent attacker to run arbitrary operating-system commands on the device by supplying maliciously crafted input that the firmware fails to validate. The CVSS 3.1 base score is 9.8 and the vector marks the flaw as network-reachable with no authentication or user interaction, yielding full confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. | CRITICAL | 9.8 | 0.9% | 50 |
|
| CVE-2026-50747 | Privilege escalation in Ubiquiti's UniFi Talk Application allows an authenticated attacker holding a low-privileged account to chain multiple SQL injection flaws (CWE-89) and gain elevated control over the underlying host device. The issue carries a critical 9.9 CVSS score driven by network reachability, low attack complexity, and a scope change from the application into the host OS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low bar of only needing minimal authenticated access makes this a high-priority patch for exposed UniFi Talk deployments. | CRITICAL | 9.9 | 0.2% | 50 |
|
| CVE-2026-55115 | Privilege escalation via Server-Side Request Forgery in Ubiquiti's UniFi Protect Application allows a low-privileged, network-adjacent attacker to coerce the application into making attacker-controlled requests and escalate to control of the host device. The CVSS 9.9 rating is driven by a scope change (S:C) plus full confidentiality, integrity, and availability impact, meaning the SSRF crosses a security boundary from the application into the underlying host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided. | CRITICAL | 9.9 | 0.2% | 50 |
|
| CVE-2026-77534 | Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to elevate to higher privileges on the affected device or instance due to an improper access control flaw. The issue spans Ubiquiti's core managed platforms - UniFi OS Server, Cloud Keys, Dream Machines/Routers, Cloud Gateways, NVR/Enterprise NVR, Enterprise NAS, and Enterprise Firewall/Fortress Gateway - and carries a critical CVSS 9.9 with a changed scope. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make it high priority. | CRITICAL | 9.9 | 0.2% | 50 |
|
| CVE-2026-77536 | Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate their rights to full administrative control, per Ubiquiti Security Advisory Bulletin 067 (CVE-2026-77536). The flaw stems from improper access control (CWE-284) and carries a near-maximum CVSS 9.9 due to a scope-changing impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.2% | 50 |
|