CVE-2026-77554 – Ubiquiti UniFi
“Three maximum-severity flaws expose UniFi environments to command execution and authentication bypass from the network.”
Ubiquiti fixes three Critical vulnerabilities across UniFi Protect, UniFi OS, and UniFi Talk. CVE-2026-77537 allows a network-accessible attacker to inject commands on devices running vulnerable UniFi Protect versions. CVE-2026-77550 allows authentication bypass on affected UniFi OS devices or instances through improper CRLF handling. CVE-2026-77554 allows command injection on devices running vulnerable UniFi Talk versions.
CVE-2026-77537 has a CVSS score of 10.0, Critical severity. CVE-2026-77550 has a CVSS score of 10.0, Critical severity. CVE-2026-77554 has a CVSS score of 10.0, Critical severity. UniFi Protect 7.2.105 and UniFi Talk 5.3.2 contain the respective application fixes, with Ubiquiti security updates addressing the affected UniFi OS platforms.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-20